start--ligrecom--cdn[.]pages[.]dev

PhishDestroy identifies start--ligrecom--cdn.pages.dev as a suspected crypto drainer domain currently under active investigation for phishing activities.

This domain exhibits multiple red flags across technical and behavioral indicators. VirusTotal currently flags it with 9 out of 95 detections, indicating no antivirus engines have flagged it despite suspicious activity. The domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.97.3, which hosts multiple known malicious infrastructures. The SSL certificate issued by Google Trust Services adds a false veneer of legitimacy to the malicious pages. While the exact registration date isn't specified in available data, the combination of zero detections with active malicious hosting suggests this is a recently deployed threat infrastructure designed to evade initial detection systems.

The specific threat posed by start--ligrecom--cdn.pages.dev appears to be a crypto drainer, which would automatically transfer cryptocurrency assets from victims' wallets upon connection. This type of attack typically involves impersonating legitimate cryptocurrency services or wallet interfaces to trick users into connecting their wallets. The domain's structure using Cloudflare Pages suggests an attempt to leverage legitimate cloud services to host malicious content, while the Google Trust Services SSL certificate provides false security indicators to potential victims.

Users should immediately avoid interacting with start--ligrecom--cdn.pages.dev and verify any cryptocurrency-related links through official channels. The domain shows no current detection in VirusTotal's database despite active malicious hosting, highlighting the need for proactive threat intelligence rather than relying solely on automated detection systems. Always verify domains through trusted sources like PhishDestroy before any cryptocurrency transactions or wallet connections. For organizations, this domain should be immediately blocked at the network level and reported to relevant threat intelligence platforms.