# auth-ledgr-wlt.pages.dev — MALICIOUS

> auth-ledgr-wlt.pages.dev is a confirmed crypto drainer impersonating Ledger Wallet. 10/95 security vendors flagged this domain.

## Summary
PhishDestroy identifies auth-ledgr-wlt.pages.dev as an active crypto drainer campaign impersonating Ledger Wallet. The domain leverages a fraudulent authentication page hosted on Cloudflare Pages to trick users into connecting their wallets and draining funds. No custom drainer kit was observed, but the page structure mirrors known Ledger phishing kits, indicating reuse of publicly available templates.  This domain was flagged by 10 out of 95 VirusTotal security vendors. It is registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and holds a Google Trust Services SSL certificate. The domain was created recently and currently shows no blocklist presence in PhishDestroy’s feeds, though its low VT score suggests limited but growing detection.  The campaign remains active as of the latest scan. PhishDestroy has added this domain to its blocklists and issued takedown requests to Cloudflare. Despite these actions, users accessing the domain via unfiltered networks or cached links remain at elevated risk of fund loss. Remaining risk is elevated due to domain agility and the use of legitimate cloud infrastructure.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 10 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/auth-ledgr-wlt.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/auth-ledgr-wlt.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/auth-ledgr-wlt.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/auth-ledgr-wlt.pages.dev/
Last updated: 2026-04-02