# start-ledger-liv.pages.dev — SUSPICIOUS

> Site start-ledger-liv.pages.dev masquerades as a crypto wallet login but carries a live crypto-draining script. It resolves to IP 188.114.97.

## Summary
PhishDestroy identifies start-ledger-liv.pages.dev as a currently active crypto-draining domain that claims to be a wallet login portal. Visitors who enter credentials risk immediate theft of digital assets to an attacker-controlled address. The page is hosted on Cloudflare Pages, uses a Google Trust Services certificate, and resolves to IP 188.114.97.3.  

This domain was flagged by PhishDestroy’s automated pipeline with the unique seed 4fe63a; VirusTotal currently shows 0 out of 95 engines flagging the page, indicating it has evaded broad detection. The domain is registered through Cloudflare, Inc., using Pages.dev hosting under a legitimate Google-issued SSL certificate. The precise IP mapping provides a concrete indicator for network-level blocking and forensics teams.  

If you have visited start-ledger-liv.pages.dev, disconnect from the internet immediately and inspect your wallet’s transaction history for any unauthorized transfers. Revoke any browser extensions related to wallet access and rotate all seed phrases and private keys stored in the browser’s local storage. Report the incident to your wallet provider and submit a support ticket referencing the seed 4fe63a for faster triage.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/191e0405-ed79-4795-90a2-be165f734fd7
- PhishDestroy: https://phishdestroy.io/domain/start-ledger-liv.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/start-ledger-liv.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/start-ledger-liv.pages.dev/
Last updated: 2026-03-22