defi-live[.]pages[.]dev

PhishDestroy identifies defi-live.pages.dev as an active crypto drainer domain designed to steal cryptocurrency assets from unsuspecting users. This fraudulent site mimics legitimate DeFi platforms to trick victims into connecting their wallets, where malicious scripts drain funds without consent. The domain operates under Cloudflare's infrastructure, resolving to IP 188.114.96.3, and leverages a Google Trust Services SSL certificate to appear legitimate. Despite its current 0/95 detection rate on VirusTotal, this domain remains untrusted and poses a significant risk to users engaging with its services. This domain was flagged with 0 detections out of 95 antivirus engines on VirusTotal, indicating it evades immediate detection despite its malicious nature. Registered through Cloudflare, Inc., the site uses a Google Trust Services SSL certificate to establish false credibility. While its creation date and blocklist counts remain unverified, its active status and association with crypto drainer operations warrant extreme caution. Security researchers should monitor its activity, as its low detection rate may mask broader campaigns targeting DeFi users. If you visited defi-live.pages.dev, disconnect your wallet immediately and revoke any unauthorized permissions via your wallet's settings. Do not interact with this domain further, and report the site to PhishDestroy for verification. Use trusted security tools to scan your device for malware and consider changing passwords linked to cryptocurrency accounts. Stay vigilant—crypto drainers evolve rapidly, and even low-detection domains can pose severe threats.