live-legor-io[.]pages[.]dev

PhishDestroy identifies an active crypto drainer campaign linked to domain live-legor-io.pages.dev. This fraudulent site mimics legitimate services to trick users into connecting crypto wallets and approving malicious transactions that drain funds directly. The threat involves unauthorized cryptocurrency transfers facilitated by deceptive domain hosting and social engineering tactics. This domain was flagged by PhishDestroy’s threat intelligence pipeline on seed 8e1804. VirusTotal analysis shows 0 detections out of 95 engines as of the latest scan, indicating it remains under the radar of most security tools. The domain resolves to IP 172.66.44.244 via Cloudflare Pages, a hosting service often abused by threat actors to obfuscate origin. The SSL certificate is issued by Google Trust Services, which does not indicate legitimacy—attackers frequently use trusted issuers to appear credible. While the exact registration date is not disclosed, the use of Cloudflare Pages suggests recent deployment, likely within the past 30 days. If you visited live-legor-io.pages.dev or interacted with it, immediately disconnect your wallet from the site and revoke any token approvals using tools like Etherscan’s Token Approval Checker or Revoke.cash. Do not approve any transaction prompts or sign messages you did not initiate. Clear your browser cache and run a full antivirus scan. Report the domain to your wallet provider and file a complaint with local cybercrime units or platforms like Google Safe Browsing. Always verify URLs manually and use hardware wallets or official app links when transacting crypto.