hardware-ledzer-wallet[.]pages[.]dev

This domain, hardware-ledzer-wallet.pages.dev, is flagged as a crypto drainer phishing site designed to compromise cryptocurrency wallets by tricking users into authorizing malicious transactions. Analysis indicates the infrastructure mimics legitimate hardware wallet interfaces, likely exploiting brand recognition to facilitate unauthorized fund transfers. The threat type aligns with known drainer kits that automate the siphoning of digital assets once wallet access is granted. Infrastructure analysis reveals the domain was registered through Cloudflare on September 16, 2025, and resolves to the IP address 172.66.44.159, hosted under AS13335 (Cloudflare, Inc.). Security vendor detections on VirusTotal report 17/95 flags, while the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential redirects to active clones or secondary infrastructure operated by the same threat actor. Users who interacted with the domain prior to its takedown should revoke any wallet authorizations, monitor transaction histories for unauthorized activity, and verify future wallet connections against known legitimate sources. Continuous monitoring of associated indicators—such as the IP range 172.66.44.0/24—is recommended to detect resurfacing threats.