walllttt---liivee--ldgrrr---usee[.]pages[.]dev

PhishDestroy identifies walllttt---liivee--ldgrrr---usee.pages.dev as a live crypto-draining phishing page. The domain mimics a legitimate login portal to siphon cryptocurrency wallet credentials and seed phrases. Victims who enter their recovery phrases risk immediate fund theft; traffic is redirected to attacker-controlled wallets after authentication. The page is delivered via Cloudflare Pages, leveraging Google Trust Services SSL certificates to appear authentic, increasing the chance of user deception. This domain was flagged through automated sandbox analysis revealing zero detections on VirusTotal (3/95 engines as of the latest scan). Hosted on IP 188.114.97.3, the site remains active despite its newly registered status under Cloudflare, Inc. It has not yet propagated to most public blocklists, allowing continued operation and potential for rapid spread through social engineering campaigns. The seed hash 8d2661 links this sample to a cluster of similar drainers targeting decentralized finance users. If you visited walllttt---liivee--ldgrrr---usee.pages.dev or entered any credentials, immediately revoke wallet permissions using tools like WalletConnect or disconnect all dApps. Do not use hardware wallets on the same network. Run a full malware scan and rotate all passwords used during the session. Report the domain to PhishDestroy for takedown and share IOCs (188.114.97.3, walllttt---liivee--ldgrrr---usee.pages.dev) to help protect others. Stay alert for follow-on spear-phishing attempts.