lddzzr-live[.]pages[.]dev

PhishDestroy identifies lddzzr-live.pages.dev as a confirmed cryptocurrency drainer domain operating under Cloudflare Pages infrastructure. The domain leverages a generic phishing kit designed to deceive victims into connecting their wallets and approving malicious token transfers. No specific brand or drainer kit variant was detected in initial analysis, but the infrastructure suggests opportunistic targeting of cryptocurrency users. The domain is currently active and under active investigation by threat intelligence teams.

Technical indicators reveal concerning attributes: VirusTotal currently scores the domain at 4/95 detections, indicating undetected malicious activity. The domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may be used to lend false legitimacy. The domain is hosted on Cloudflare Pages, a legitimate service often abused by threat actors for phishing campaigns. Additional investigation is required to determine exact creation date and potential inclusion on blocklists, though current telemetry suggests low detection rates.

The domain remains active with risk assessed as "under_investigation" despite zero VirusTotal detections. Immediate response actions include user reporting to threat intelligence platforms and browser vendors. Security teams should block the domain at DNS and network levels, particularly targeting the IP 188.114.97.3 and associated Cloudflare Pages infrastructure. Remaining risk is classified as high due to undetected status and cryptocurrency drainer capabilities. Users are strongly advised to avoid interaction and verify URLs through reputable threat intelligence sources before any wallet connection.