wallttt-----liiive----ldgrrr[.]pages[.]dev

This domain, wallttt-----liiive----ldgrrr.pages.dev, is identified as a crypto credential theft site designed to harvest sensitive user information, including wallet credentials and private keys. Analysis indicates the site employs social engineering tactics to deceive visitors into disclosing login details or authorizing malicious transactions, commonly targeting cryptocurrency users. The infrastructure mimics legitimate wallet interfaces or blockchain services, increasing the likelihood of successful exploitation by threat actors. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 03, 2026, an unusually future-dated creation that may indicate automated or obfuscated registration practices. The domain resolves to the IP address 188.114.96.3, associated with Cloudflare’s content delivery network, and presents a Google Trust Services SSL certificate. Detection metrics show 0/95 detections on VirusTotal, suggesting the campaign remains undetected by most security vendors at the time of assessment. However, the domain appears on one security blocklist, and Google Safe Browsing has flagged it under the SOCIAL_ENGINEERING category. Users who visited wallttt-----liiive----ldgrrr.pages.dev should immediately revoke any active wallet authorizations and transfer assets to a new, secure wallet. All credentials entered on the site must be considered compromised and should be changed across all platforms where they were reused. Monitoring for unauthorized transactions is critical, and affected individuals are advised to report the incident to relevant financial or blockchain security teams for further mitigation. The domain is currently offline, but users should remain vigilant for similar threats leveraging Cloudflare Pages infrastructure.