# downld-ledgr-lives.pages.dev — SUSPICIOUS

> PhishDestroy identifies downld-ledgr-lives.pages.dev as a crypto drainer posing as a legitimate platform with 0/95 VirusTotal detections.

## Summary
PhishDestroy has flagged downld-ledgr-lives.pages.dev as an active crypto drainer, a type of phishing site designed to trick users into connecting cryptocurrency wallets under false pretenses. The domain mimics legitimate services, likely targeting users expecting secure downloads or financial integrations. Once a victim connects their wallet, the site may drain tokens by exploiting smart contract approvals or fake transaction prompts. This behavior is part of a growing trend where attackers abuse cloud platforms like Google Pages to host malicious content under the guise of professional tooling.  This domain resolves to IP 188.114.97.3 and operates under a Google Trust Services SSL certificate, leveraging Cloudflare’s infrastructure for hosting. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating it has evaded current signature-based detection. The domain was registered through Cloudflare, Inc., and appears to be actively leveraging Pages.dev, a legitimate service repurposed for malicious intent. While the SSL certificate provides a veneer of legitimacy, the absence of detections suggests this is a newly deployed or carefully crafted threat.  If you visited downld-ledgr-lives.pages.dev, disconnect your wallet immediately and revoke any suspicious approvals via tools like revoke.cash or your wallet’s interface. Do not interact with pop-ups or prompts, even if they appear urgent. Clear your browser cache and run a scan with trusted security software. Report the domain to your wallet provider and consider monitoring your accounts for unauthorized transactions. Always verify domains via official channels before interacting, especially when dealing with cryptocurrency.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/76f114f4-f85f-4b93-a453-c66a65be2ee9
- PhishDestroy: https://phishdestroy.io/domain/downld-ledgr-lives.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/downld-ledgr-lives.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/downld-ledgr-lives.pages.dev/
Last updated: 2026-04-11