start-leger-live-en[.]pages[.]dev

PhishDestroy identifies the domain start-leger-live-en.pages.dev as an active generic phishing campaign leveraging a cryptocurrency wallet drainer kit. The domain mimics legitimate financial or legal services to deceive users into connecting wallets or submitting seed phrases. This campaign does not target a single brand but employs a generic approach to capture crypto assets across multiple platforms. The drainer kit is designed to drain funds from connected wallets upon user interaction, such as clicking a malicious link or approving a fraudulent transaction.

This domain was flagged through Cloudflare Pages, registered via Cloudflare, Inc., and resolves to IP address 188.114.97.3. The domain currently holds a VirusTotal detection score of 10/95, indicating it has evaded automated detection systems. It utilizes a Google Trust Services SSL certificate, adding a false sense of legitimacy. The domain is newly registered and remains unlisted on major blocklists, including Google Safe Browsing (GSB). The lack of detections and blocklist entries suggests this campaign is in its early stages, with threat actors actively testing its effectiveness.

The campaign is classified as active with a risk level under investigation, meaning further analysis is required to determine its full scope and potential impact. PhishDestroy recommends immediate caution: users should avoid interacting with this domain, verify any financial or legal communications through official channels, and report the domain to security teams or platforms like VirusTotal. While the current risk is elevated due to the drainer kit's presence, the lack of detections and blocklist entries means proactive measures are essential to prevent victimization. Remaining risk includes potential expansion to other domains or platforms, as threat actors refine their tactics.