cloude-live-eng-leajer[.]pages[.]dev

PhishDestroy has flagged cloude-live-eng-leajer.pages.dev as a cryptocurrency drainer phishing domain under active investigation. This domain mimics legitimate cloud engagement services to trick users into connecting wallets or entering credentials. The threat actor leverages a fake login portal designed to siphon crypto assets under the guise of an 'engineering leadership' engagement page. No specific drainer kit has been publicly documented yet, but the infrastructure suggests a coordinated campaign targeting crypto professionals.

Technical indicators confirm the domain's malicious intent. VirusTotal reports 7/95 detection engines have flagged this domain, despite its recent deployment. Registered through Cloudflare, Inc., the domain resolves to IP 172.66.44.57 and operates under a Google Trust Services SSL certificate to appear legitimate. While the exact creation date remains unverified, the domain's Cloudflare Pages hosting indicates rapid deployment for phishing purposes. Google Safe Browsing (GSB) has not yet blacklisted this domain, and public blocklist counts remain at zero. The absence of detections suggests evasion tactics, such as short-lived infrastructure or obfuscated payload delivery, are in play.

As of this advisory, the domain remains active with a 'medium' risk status pending further investigation. Users are strongly advised to avoid interacting with this domain and verify any unsolicited 'cloud engagement' links via PhishDestroy's real-time checker. The current lack of blacklisting underscores the need for proactive threat hunting. While the immediate risk is localized to users tricked by spoofed credentials or wallet connections, the domain's infrastructure could be repurposed for broader campaigns. Security teams should monitor for related IOCs (e.g., similar .pages.dev domains) and block 172.66.44.57 at the network perimeter. Remaining risk hinges on user awareness and timely domain takedowns.