ledgrr-cum-eng[.]pages[.]dev

PhishDestroy identifies ledgrr-cum-eng.pages.dev as a fraudulent domain currently staging a targeted Ledger wallet phishing campaign. The site hosts a drainer kit disguised as a ‘Ledger Recovery Tool’ to trick victims into surrendering seed phrases or private keys. Cloudflare serves the payload from the legitimate Pages.dev platform, leveraging Google Trust Services SSL to appear genuine and bypass naive browser warnings. Creation date remains under investigation, but Cloudflare registration and 188.114.96.3 hosting point to a recently activated infrastructure aligned with similar stealers observed since October 2024. This domain was flagged with a still-low VirusTotal score of 1/95 detections across 95 engines as of the latest scan, indicating a zero FUD payload at time of assessment. Registrar details confirm Cloudflare, Inc., while the resolved IP 188.114.96.3 belongs to Cloudflare’s edge network, a common obfuscation layer for malicious pages seeking bullet-proof uptime. Google Safe Browsing (GSB) has not yet listed the domain, and public blocklists such as PhishTank currently show zero hits, leaving browsers and endpoint users exposed. The threat is marked active and under continued investigation by multiple threat-intel teams. No official takedown or sinkholing actions have been applied to 188.114.96.3 or the domain itself at this moment, so the drainer remains reachable. Given the zero-detection status and recent activation, the risk level remains elevated and could escalate quickly once the payload or infrastructure is weaponized further. Users should treat any unsolicited Ledger-related links as malicious until independent verification is performed.