life-plus-plus[.]pages[.]dev

PhishDestroy identifies life-plus-plus.pages.dev as an active phishing domain leveraging a Google Trust Services SSL certificate to impersonate a legitimate service while pushing a cryptocurrency drainer. The page is served from IP 172.66.47.127 and resolves via Cloudflare’s infrastructure, making it harder to block at the network level. This specific combination of trusted branding and crypto-draining payloads mirrors recently documented campaigns aimed at siphoning digital assets through fake wallet connections or credential harvesting pages.

Technical analysis shows this domain remains undetected by 95 scanners on VirusTotal as of the latest submission, indicating a low signature presence in threat feeds. Registered through Cloudflare, Inc., the domain benefits from Cloudflare’s rapid provisioning and anonymization, complicating historical attribution. Despite the absence of immediate blocklist inclusion, its purpose becomes clear upon inspection: a deceptive frontend designed to trick users into authorizing malicious smart contract interactions or submitting sensitive wallet information. The presence of a valid Google Trust Services certificate further increases its credibility to unsuspecting visitors, particularly in browser contexts where green padlocks are misinterpreted as indicators of safety.

Users who have accessed this site should immediately revoke any wallet connections or browser permissions granted to untrusted scripts. Disconnect affected wallets using tools like WalletConnect or revoke permissions via blockchain explorers (e.g., Etherscan, Solscan). Clear browser cache and cookies, and consider using a dedicated cleanup tool like PhishDestroy to scan for lingering malware or malicious extensions. Monitor blockchain addresses and wallet balances for unauthorized transactions. Report this domain immediately via PhishDestroy’s reporting portal to help update community blocklists and prevent further victimization.