lunaclassic-migration[.]pages[.]dev

This domain, lunaclassic-migration.pages.dev, is actively distributing a crypto drainer phishing scheme targeting users under the guise of "Staking" services. Analysis indicates the site mimics legitimate cryptocurrency staking platforms, likely designed to harvest wallet credentials or execute unauthorized transactions. No specific drainer kit has been attributed, but the page title and domain naming convention suggest an intent to deceive users of the Luna Classic ecosystem. Infrastructure analysis reveals the domain was registered on August 09, 2024, through Cloudflare, Inc. It resolves to the IP address 172.66.46.252, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The domain appears on 2 security blocklists, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing status is not explicitly listed, but the domain remains active and unblocked by default in most consumer browsers. Current status indicates the domain is still operational, posing an ongoing risk to users. Response actions by security vendors include blocking by PhishDestroy and ScamSniffer, though broader mitigation requires manual intervention. The remaining risk is classified as high due to the domain's active status, low detection rate, and targeting of cryptocurrency users. Users are advised to avoid interaction, verify domain authenticity via official channels, and employ wallet transaction simulation tools to detect unauthorized transfers.