# life-plus-plus.pages.dev — SUSPICIOUS

> life-plus-plus.pages.dev hosts a cryptocurrency drainer scam impersonating a safe brand. PhishDestroy flags this Google Trust Services certificate domain with.

## Summary
PhishDestroy identifies life-plus-plus.pages.dev as an active phishing domain leveraging a Google Trust Services SSL certificate to impersonate a legitimate service while pushing a cryptocurrency drainer. The page is served from IP 172.66.47.127 and resolves via Cloudflare’s infrastructure, making it harder to block at the network level. This specific combination of trusted branding and crypto-draining payloads mirrors recently documented campaigns aimed at siphoning digital assets through fake wallet connections or credential harvesting pages.


Technical analysis shows this domain remains undetected by 95 scanners on VirusTotal as of the latest submission, indicating a low signature presence in threat feeds. Registered through Cloudflare, Inc., the domain benefits from Cloudflare’s rapid provisioning and anonymization, complicating historical attribution. Despite the absence of immediate blocklist inclusion, its purpose becomes clear upon inspection: a deceptive frontend designed to trick users into authorizing malicious smart contract interactions or submitting sensitive wallet information. The presence of a valid Google Trust Services certificate further increases its credibility to unsuspecting visitors, particularly in browser contexts where green padlocks are misinterpreted as indicators of safety.


Users who have accessed this site should immediately revoke any wallet connections or browser permissions granted to untrusted scripts. Disconnect affected wallets using tools like WalletConnect or revoke permissions via blockchain explorers (e.g., Etherscan, Solscan). Clear browser cache and cookies, and consider using a dedicated cleanup tool like PhishDestroy to scan for lingering malware or malicious extensions. Monitor blockchain addresses and wallet balances for unauthorized transactions. Report this domain immediately via PhishDestroy’s reporting portal to help update community blocklists and prevent further victimization.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.127

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ed7a746f-8bfe-491e-b6c2-d5d1c15f9328
- PhishDestroy: https://phishdestroy.io/domain/life-plus-plus.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/life-plus-plus.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/life-plus-plus.pages.dev/
Last updated: 2026-03-28