eng-livelgr-access[.]pages[.]dev

PhishDestroy identifies eng-livelgr-access.pages.dev as an active crypto drainer phishing domain currently under investigation.

This domain was flagged by 3 of 95 VirusTotal vendors at the time of analysis. Registered through Cloudflare, Inc., it resolves to IP 172.66.45.43 and operates under a Google Trust Services SSL certificate. The domain leverages Cloudflare Pages for hosting, a common tactic among threat actors to rapidly deploy malicious infrastructure while evading traditional detection mechanisms.

Risk assessment for eng-livelgr-access.pages.dev remains under active investigation due to the absence of vendor detections despite clear malicious intent. Cloudflare’s hosting infrastructure and Google’s SSL certification complicate traditional blocking strategies, increasing the risk of successful user compromise. Users are strongly advised to verify all URLs through PhishDestroy’s real-time scanning tools before engaging with links or entering credentials. Organizations should consider blocking this domain at the network perimeter and educating users about the tactics employed by crypto drainer campaigns, including the use of legitimate cloud providers to host malicious content. Immediate takedown requests should be submitted to Cloudflare’s abuse team referencing the unique seed identifier ed373a for expedited processing.