learn-live-en-ldgr[.]pages[.]dev

PhishDestroy identifies learn-live-en-ldgr.pages.dev as an active crypto drainer domain impersonating a legitimate learning platform to harvest cryptocurrency credentials. The domain leverages a fraudulent 'Learn Live' interface to trick victims into connecting wallets or entering seed phrases, while silently draining funds. No specific drainer kit variant has been isolated in open-source intelligence, but the domain’s structure suggests a generic but effective crypto theft framework designed for rapid deployment and evasion. The threat actor’s infrastructure prioritizes agility, using subdomain abuse under Cloudflare Pages to bypass traditional domain-based detection layers. 8d05e7 This domain exhibits several technical indicators of compromise. VirusTotal currently reports 3 out of 95 detection engines flagging the domain, indicating low signature coverage despite behavioral anomalies. The domain is registered through Cloudflare, Inc. and resolves to IP 172.66.44.176, a Cloudflare edge node often abused by threat actors for hosting malicious content due to its legitimate reputation and fast propagation. The SSL certificate is issued by Google Trust Services, which increases user trust and lowers suspicion. While the exact creation date is not publicly disclosed, the domain’s presence on Cloudflare Pages suggests recent deployment—likely within the last 30 days. Google Safe Browsing (GSB) has not yet flagged the domain, and no known blocklists currently include it, leaving a critical detection gap. 8d05e7 As of today, the domain remains active and under active threat investigation. The current risk level is marked as 'under_investigation,' with no confirmed attribution or campaign association. Immediate response actions include blocking the domain at DNS and network levels, flagging the IP range 172.66.44.0/24 for further scrutiny, and coordinating with Cloudflare Trust & Safety to take down the malicious Pages deployment. Users are advised to avoid interacting with any 'learn-live' themed domains and to verify all URLs via official sources before entering credentials or connecting wallets. Remaining risk is high due to the domain’s low detection profile, legitimate infrastructure abuse, and active hosting environment. Proactive monitoring and rapid takedown coordination are essential to mitigate potential victimization. 8d05e7