en-us-lives-legre[.]pages[.]dev

PhishDestroy identifies en-us-lives-legre.pages.dev as an active crypto drainer campaign, currently under investigation with a status of 'active' and risk level marked as 'under_investigation.' This domain leverages deceptive branding to trick users into connecting crypto wallets, enabling unauthorized fund transfers. The threat is operational and spreading via phishing channels, though its exact scale and victim count remain undetermined. Immediate action is required to prevent financial loss.

This domain was flagged through PhishDestroy’s pipeline with the unique seed f2d1f3. Technical indicators include a valid SSL certificate issued by Google Trust Services, 0 detections out of 95 on VirusTotal as of the latest scan, registration through Cloudflare, Inc., and resolution to IP 172.66.44.159. The domain’s infrastructure suggests evasion tactics, such as using Cloudflare’s Pages.dev platform to obscure malicious intent. No blocklist entries were detected at the time of analysis, and the domain has not yet been widely flagged by security vendors. Its low detection rate indicates it is likely a newly deployed or niche campaign.

Users are strongly advised to avoid interacting with en-us-lives-legre.pages.dev or any linked pages. For crypto-related activity, verify domains against PhishDestroy’s live blocklist and cross-check URLs via reputable sources. If exposure occurs, disconnect wallets immediately and revoke any unauthorized permissions using tools like revoke.cash or your wallet’s official extension. Report suspicious activity to PhishDestroy’s threat intake system to aid in rapid takedown efforts.