en-live-le-dgr[.]pages[.]dev

This domain is assessed as a high-risk brand impersonation infrastructure targeting a known crypto wallet ecosystem. The site is designed to mimic a legitimate portfolio management and authentication portal, likely aiming to capture login credentials, recovery phrases, and session tokens. Such pages typically serve as initial access points for account takeover and unauthorized asset transfer, with user interaction being the primary compromise vector.

Technical indicators show multiple corroborating risk signals. VirusTotal reports 8/95 security vendors flagging the domain. The domain was created on September 19, 2025, indicating recent infrastructure deployment. It resolves to IP 172.66.47.193 under AS13335 (Cloudflare, Inc.), suggesting use of CDN masking and rapid hosting rotation. SSL certificate is issued by Google Trust Services (WE1). The domain is currently active and appears on 1 security blocklist, reinforcing ongoing malicious availability.

If a user has visited or interacted with this domain, immediate containment actions are recommended. Credentials potentially entered should be considered compromised and must be changed from a trusted device. Any associated accounts should have session tokens revoked and multi-factor authentication enabled or reconfigured. If a recovery phrase or private key was exposed, affected assets should be migrated to a new secure wallet immediately. Additionally, a full malware scan is advised to detect potential keyloggers or browser-based credential capture mechanisms. Monitoring for unauthorized transactions should continue over subsequent days.