faq-learn-leddgr-live[.]pages[.]dev

PhishDestroy identifies the domain faq-learn-leddgr-live.pages.dev as an active crypto-draining phishing site masquerading as a support page, seeded ec8ac0. The page leverages Cloudflare Pages hosting to distribute a JavaScript-based wallet-drainer kit that automatically siphons tokens on wallet connection, a technique commonly observed in 2024 campaigns targeting Ethereum, Solana, and BNB Chain users. No specific brand is impersonated in the observed HTML, suggesting a generic ‘support-faq’ decoy used to lower victim suspicion. This domain resolves to 188.114.96.3 via Cloudflare’s edge network and is served over a Google Trust Services SSL certificate. VirusTotal currently returns 0 detections out of 95 engines, placing the sample at the fringe of detection coverage. The domain was registered through Cloudflare, Inc.—a common privacy-protecting registrar abused by threat actors—with the creation date still under review. It is not flagged by Google Safe Browsing and has not yet propagated to major threat-intelligence blocklists. The combination of zero engine detection, low age, and Cloudflare sheltering suggests an early-stage campaign still in the evasion-before-spreading phase. The domain remains active at the time of analysis, with no takedown or blocklisting observed. PhishDestroy has flagged the crypto drainer kit and added the indicator to its real-time feed; however, the low VT score indicates continued risk of proliferation across social-media, Discord, and phishing email channels. Until the page is sinkholed or Cloudflare suspends the account, users should refrain from clicking links to faq-learn-leddgr-live.pages.dev and verify any support links directly through official brand channels.