starts-live-wlt-en[.]pages[.]dev

PhishDestroy identifies starts-live-wlt-en.pages.dev as an active phishing domain impersonating wallet login interfaces to harvest user credentials. The domain is currently flagged as generic phishing and remains under investigation by security researchers. This domain was flagged by 3 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious. It is registered through Cloudflare, Inc., resolving to IP address 172.66.47.152, and utilizes a Google Trust Services SSL certificate. The domain is hosted on Cloudflare Pages, a legitimate platform, which complicates detection due to the shared infrastructure with benign sites. Despite its current lack of detections, the absence of brand protection measures and the use of a generic subdomain pattern suggest malicious intent. As of the latest assessment, starts-live-wlt-en.pages.dev remains active and poses a moderate risk of credential theft through deceptive wallet login impersonation. Users are strongly advised to avoid interacting with this domain and report it to their security teams or browser vendors. Security researchers should monitor this domain for emerging detections or shifts in threat behavior. Additionally, organizations should reinforce user awareness regarding phishing tactics involving fake wallet login pages to mitigate potential exposure.