private-ledgr-doc[.]pages[.]dev

PhishDestroy identifies the domain private-ledgr-doc.pages.dev as an active generic phishing site impersonating Ledger wallet hardware, currently under investigation. This domain employs a drainer kit designed to trick users into connecting their crypto wallets and transferring funds to attacker-controlled addresses. The site mimics the legitimate Ledger interface to harvest private keys or seed phrases, leveraging deceptive subdomains and Cloudflare’s infrastructure to evade detection and prolong operational uptime. This domain was flagged on 2024-05-17 and shows the following technical indicators: it scored 2/95 on VirusTotal with no antivirus detections, is registered through Cloudflare, Inc., resolves to IP address 188.114.97.3, and operates with a valid SSL certificate issued by Google Trust Services. The domain is relatively new and not yet listed on major blocklists such as Google Safe Browsing, which currently shows no block status. As of now, there are no confirmed reports of it being actively blocked by browsers or security vendors. The domain remains active and poses a moderate-to-high risk to cryptocurrency users, particularly those with Ledger wallets. PhishDestroy recommends users avoid interacting with this domain entirely and check their transaction histories for unauthorized activity. While the immediate risk is elevated due to the drainer kit’s presence, no widespread compromise has been confirmed. Users are advised to revoke any connected wallet permissions, enable two-factor authentication, and monitor their accounts for suspicious transfers. Blocking the IP 188.114.97.3 at the network level is also advised as an additional precaution.