# s-tart-led-gr.pages.dev — MALICIOUS

> PhishDestroy flags s-tart-led-gr.pages.dev as an active crypto drainer scam impersonating Google Sites.

## Summary
PhishDestroy identifies s-tart-led-gr.pages.dev as an active crypto drainer scam hosted on Google Sites (pages.dev). The threat type is generic_phishing with elevated risk status. The campaign does not impersonate a specific brand beyond leveraging Google’s infrastructure; instead, it pushes a crypto-draining payload via a fraudulent site claiming to offer Ledger wallet integration. This domain appears to be a disposable landing page generated to evade detection and distribute malicious scripts to cryptocurrency users.

This domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc. It holds a legitimate SSL certificate issued by Google Trust Services. VirusTotal analysis shows the domain has a detection score of 15 out of 95 security vendors flagging it, indicating partial but not universal recognition. No specific creation date was provided in open sources; however, the use of a Google Pages (pages.dev) subdomain suggests recent deployment aimed at abusing Google’s trusted domain ecosystem. The domain has not been blocklisted by Google Safe Browsing (GSB) at the time of analysis.

Current status remains active, with the site actively serving malicious content. PhishDestroy has flagged this domain and added it to real-time blocklists. Immediate remediation includes domain takedown requests to Cloudflare and Google Trust Services, and IP de-listing. Despite these actions, the risk remains elevated due to the use of legitimate cloud infrastructure and short-lived disposable domains. Users are strongly advised to verify any Google Sites link through PhishDestroy before interacting, especially those related to cryptocurrency transactions.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cb2d5903-8194-4930-b982-64099fb33fb4
- PhishDestroy: https://phishdestroy.io/domain/s-tart-led-gr.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/s-tart-led-gr.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/s-tart-led-gr.pages.dev/
Last updated: 2026-03-22