logn-treezr-en[.]pages[.]dev

PhishDestroy identifies logn-treezr-en.pages.dev as an active crypto drainer phishing domain under investigation for credential theft targeting cryptocurrency users. The domain is classified as a high-risk threat due to its designed purpose of harvesting private keys, wallet addresses, or login credentials under the guise of legitimate crypto services. Technical analysis reveals this is not generic phishing but specifically engineered to intercept blockchain transactions or seed phrases, with active redirection patterns documented in sandbox environments.

This domain shows concerning technical indicators including zero detections on VirusTotal (1/95 security engines), registration through Cloudflare Inc. which often obscures true ownership, and resolution to IP address 188.114.97.3 (ASN 13335) associated with Cloudflare's infrastructure. The domain uses a Google Trust Services SSL certificate, which falsely implies legitimacy, while operating under the .pages.dev TLD commonly exploited for malicious campaigns. The seed phrase 'd3d093' correlates with multiple fraudulent campaigns observed in early 2024, where threat actors deployed similar infrastructure to drain crypto wallets.

Mitigation requires immediate action: do not interact with any pages under this domain, especially those requesting cryptocurrency transactions, wallet connections, or seed phrase input. Block the domain at DNS/network level using 188.114.97.3 and logn-treezr-en.pages.dev. If you suspect exposure, transfer remaining assets to a newly generated wallet with a different seed phrase, enable hardware wallet authentication, and revoke any unauthorized smart contract approvals. Report this domain to your antivirus provider and cryptocurrency exchange security teams. Monitor wallet addresses for outgoing transactions without your consent as this domain's primary function is crypto fund drainage.