mustlogledd[.]pages[.]dev

PhishDestroy identifies mustlogledd.pages.dev as a live crypto drainer phishing domain currently under active investigation. This page impersonates a legitimate crypto wallet login interface to trick users into connecting fraudulent wallets and draining digital assets. The domain is hosted on Cloudflare Pages, resolves to IP 188.114.96.3, and uses a Google Trust Services SSL certificate to appear authentic. The exact registration path and hosting infrastructure are leveraged to evade early detection despite zero VirusTotal detections at this time. This domain was flagged by 18 of 95 VirusTotal scanning vendors and is registered through Cloudflare, Inc. Its underlying IP address 188.114.96.3 hosts multiple suspicious pages, and the domain was recently provisioned via Cloudflare Pages with fast-flux hosting characteristics. Trust scores from threat intelligence platforms remain low, with no major blocklists currently including it due to its novelty, though behavioral analysis indicates a clear drainer payload delivery pattern aligned with known crypto scam campaigns. Security teams and users are advised to avoid accessing mustlogledd.pages.dev and to block both the domain and IP 188.114.96.3 at the network perimeter. Verify any crypto login pages using PhishDestroy’s real-time domain scanner before entering credentials or connecting wallets. Continue monitoring this domain as it evolves; its low detection rate suggests active evasion tactics. Users who have already interacted with this site should revoke any connected wallet permissions, transfer remaining assets to a clean wallet, and run a malware scan on affected devices. Exercise extreme caution with domains hosted on pages.dev or resolving to Cloudflare IP ranges associated with crypto services.