auth-ledgr-wlt[.]pages[.]dev

PhishDestroy identifies auth-ledgr-wlt.pages.dev as an active crypto drainer campaign impersonating Ledger Wallet. The domain leverages a fraudulent authentication page hosted on Cloudflare Pages to trick users into connecting their wallets and draining funds. No custom drainer kit was observed, but the page structure mirrors known Ledger phishing kits, indicating reuse of publicly available templates. This domain was flagged by 10 out of 95 VirusTotal security vendors. It is registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and holds a Google Trust Services SSL certificate. The domain was created recently and currently shows no blocklist presence in PhishDestroy’s feeds, though its low VT score suggests limited but growing detection. The campaign remains active as of the latest scan. PhishDestroy has added this domain to its blocklists and issued takedown requests to Cloudflare. Despite these actions, users accessing the domain via unfiltered networks or cached links remain at elevated risk of fund loss. Remaining risk is elevated due to domain agility and the use of legitimate cloud infrastructure.