earn-lavanet[.]pages[.]dev

The domain earn-lavanet.pages.dev has been identified as an active crypto drainer, a specialized form of phishing designed to illicitly transfer cryptocurrency assets from unsuspecting victims. This threat is classified as elevated due to its targeting of digital asset holders and the deceptive tactics employed to trick users into connecting their wallets or entering credentials. Unlike generic phishing attempts, crypto drainers actively exploit blockchain transaction mechanics to siphon funds in real-time, making them particularly dangerous in the Web3 ecosystem.

This domain was flagged by multiple security vendors, including Enkrypt and ScamSniffer, with additional confirmations from 2 out of 95 VirusTotal analyzers. The infrastructure behind the domain resolves to IP address 172.66.47.113, which is hosted via Cloudflare, Inc. The domain leverages a Google Trust Services SSL certificate, potentially adding a veneer of legitimacy. Notably, it has been cataloged on two separate blocklists, indicating prior detections of malicious behavior. These attributes collectively underscore the domain's malicious intent and operational sophistication.

Organizations and individuals should immediately block this domain at the network perimeter and instruct users to avoid interactions with any associated URLs or subdomains. Users who may have engaged with earn-lavanet.pages.dev should review their wallet transactions for unauthorized transfers and revoke any connected permissions through blockchain explorers or wallet interfaces. Implementing browser extensions or security tools that detect crypto drainer signatures can provide an additional layer of defense. Regularly monitoring threat intelligence feeds for emerging indicators will help preempt future exposure to similar threats.