ldegr-lie-walett-en[.]pages[.]dev

PhishDestroy identifies ldegr-lie-walett-en.pages.dev as an active crypto drainer domain masquerading as a legitimate service. The infrastructure leverages Cloudflare Pages for hosting, with SSL certificates issued by Google Trust Services to enhance credibility. While no specific drainer kit has been publicly analyzed yet, the domain’s configuration aligns with known patterns used to intercept cryptocurrency transactions via fake login portals or wallet connection prompts. This domain exhibits several technical red flags confirmed by PhishDestroy. VirusTotal currently flags it with 0 detections out of 95 scanners, indicating it remains under the radar despite active abuse. Registered through Cloudflare, Inc., it resolves to IP 188.114.96.3—a range associated with malicious activity in prior investigations. The domain’s SSL certificate, issued by Google Trust Services, may be leveraged to evade browser-based security warnings, further complicating detection. At present, this domain has not been flagged in Google Safe Browsing (GSB) and remains unblocked by major threat intelligence platforms. The threat posed by ldegr-lie-walett-en.pages.dev is currently classified as active and under investigation by PhishDestroy’s threat intelligence team. Immediate remediation efforts include flagging the domain for takedown via Cloudflare’s abuse channels and updating internal blocklists to prevent access. Users are strongly advised to avoid interacting with this domain or any linked cryptocurrency-related prompts. While the risk is elevated due to the domain’s active status and lack of detections, proactive verification on PhishDestroy’s platform can mitigate exposure. Remaining risks include potential evolution into more sophisticated phishing or malware distribution campaigns if left unaddressed.