getledg-us[.]pages[.]dev

The domain getledg-us.pages.dev has been identified as involved in a credential theft campaign, specifically targeting users in the cryptocurrency sector. While no direct brand impersonation or drainer kits have been confirmed, the domain’s naming convention suggests an attempt to mimic legitimate crypto-related services to deceive victims into disclosing sensitive login information.

Technical analysis reveals that getledg-us.pages.dev currently holds a VirusTotal detection score of 1/95, indicating it has not yet been flagged by major antivirus engines. The domain is registered through Cloudflare, Inc. and is protected by an SSL certificate issued by Google Trust Services, lending it a superficial appearance of legitimacy. It resolves to the IP address 188.114.96.3. Although the creation date of the domain is not specified, no Google Safe Browsing (GSB) warnings or blocklist entries have been reported at this time.

The domain’s status remains active and under investigation. Given the absence of detections on VirusTotal and no blocklist reports, this threat may be in early stages or employing evasion tactics. Users are advised to remain vigilant, avoid entering credentials on suspicious pages, and verify URLs when accessing crypto platforms. Security teams should monitor the domain for emerging indicators of compromise and consider proactive blocking until further assessment is completed.