en-us-ledgstart[.]pages[.]dev

PhishDestroy identifies en-us-ledgstart.pages.dev as an active crypto drainer phishing site with elevated risk. The page mimics Ledger Live’s authentication flow to trick users into connecting wallets and transferring funds to attacker-controlled addresses. PhishDestroy’s automated analysis reveals the domain is served over an SSL certificate issued by Google Trust Services, indicating attackers leveraged Cloudflare’s infrastructure to host the page. VirusTotal shows only 1 of 95 security vendors currently detect the threat, reflecting low coverage against this novel campaign. The domain resolves to IP 172.66.44.195, a Cloudflare IP commonly used to obfuscate malicious content. The page is hosted on Cloudflare Pages (pages.dev), a legitimate service that attackers abuse to rapidly deploy impersonation sites. Creation and hosting metadata aligns with recently observed crypto-drainer campaigns targeting hardware wallet users. Mitigation requires immediate user verification on PhishDestroy before any wallet connection. Users should avoid visiting en-us-ledgstart.pages.dev and report the domain to their wallet provider and PhishDestroy for takedown. Hardware wallet manufacturers should issue customer alerts and update their official URLs to prevent typo-squatting attacks. Blocklists and security vendors must prioritize signature updates to detect this campaign before further theft occurs.