# start-led-gr.pages.dev — SUSPICIOUS

> PhishDestroy identifies start-led-gr.pages.dev as an active crypto drainer impersonating Ledger Wallet. VirusTotal flags 0/95 engines.

## Summary
PhishDestroy identifies start-led-gr.pages.dev as an active crypto drainer targeting Ledger Wallet users. This fraudulent domain mimics legitimate Ledger interfaces to trick victims into connecting wallets and authorizing malicious transactions. Cloudflare Pages hosts the domain, which resolves to IP 172.66.47.80 and uses a Google Trust Services SSL certificate for deceptive authenticity.  This domain was flagged with 0 detections out of 95 VirusTotal engines, indicating its recent emergence and low prior exposure. Registered through Cloudflare Pages, the domain leverages free hosting to rapidly deploy phishing infrastructure while avoiding traditional detection methods. The absence of blocklist entries suggests it remains under the radar of major security vendors, increasing its potential victim base.  Users who visited this domain should immediately revoke any connected wallet permissions and transfer funds to a new, secure wallet. Do not interact with any prompts or connection requests from this domain. Verify all Ledger-related domains through official channels, and use PhishDestroy's verification tools to confirm legitimacy before proceeding with any crypto transactions.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.80

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/3a4f3743-0311-4c25-ad8d-c6dadf7baf3a
- PhishDestroy: https://phishdestroy.io/domain/start-led-gr.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/start-led-gr.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/start-led-gr.pages.dev/
Last updated: 2026-03-21