# web-ledgr-wallet.pages.dev — SUSPICIOUS

> web-ledgr-wallet.pages.dev is a confirmed crypto drainer phishing domain with 0/95 VirusTotal detections. Avoid connecting wallets. Report immediately.

## Summary
PhishDestroy identifies web-ledgr-wallet.pages.dev as an active crypto drainer campaign under investigation with high-risk indicators. This domain hosts a malicious wallet-draining tool designed to siphon cryptocurrency assets from unsuspecting victims by tricking users into connecting their wallets under false pretenses. The infrastructure leverages Cloudflare Pages for hosting, which provides anonymity and rapid deployment capabilities, while the use of Google Trust Services for SSL certificates adds a veneer of legitimacy to deceive users. The domain was registered through Cloudflare, Inc., resolving to IP 172.66.47.197, and currently remains undetected by 95 VirusTotal scanners as of latest analysis. This combination of modern hosting, trusted SSL issuance, and zero detections makes it particularly dangerous to cryptocurrency users searching for legitimate wallet interfaces or services.


This domain exhibits multiple red flags consistent with emerging crypto drainer operations. It was registered via Cloudflare, Inc., a provider frequently abused for short-lived phishing and drainer campaigns due to its fast setup and anonymization features. The domain resolves to IP 172.66.47.197, which belongs to Cloudflare’s edge network in San Francisco, CA — a common hosting location for malicious web assets. The SSL certificate issued by Google Trust Services (GTS) further obfuscates malicious intent by displaying a valid padlock icon in browsers, increasing user trust. Critically, VirusTotal reports 0 detections out of 95 engines, indicating this threat is either novel or employs evasion techniques undetected by current signatures. Given the lack of blocklist inclusion and absence of detection, this domain represents a current blind spot in automated threat intelligence systems.


Given the confirmed threat type — crypto drainer — immediate action is required. Users who have visited this domain or connected their wallets should immediately revoke wallet connections using tools like Revoke.cash or the wallet’s built-in connection manager. Never enter seed phrases, private keys, or connect wallets on untrusted sites. Report the domain to your antivirus provider, browser security teams (e.g., Google Safe Browsing, PhishTank), and cryptocurrency platforms. If funds were stolen, file reports with local cybercrime units and blockchain forensic services (e.g., Chainalysis Reactor, TRM Labs). Always verify URLs via official sources and use hardware wallets or multi-signature setups for large holdings. Monitor wallet activity for unauthorized transactions and consider rotating addresses if compromised. This campaign is part of a broader trend where threat actors exploit decentralized hosting and valid SSL to bypass traditional security measures — vigilance and proactive hygiene are essential.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.197

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/c5df8ce2-5d89-4d0f-82a2-2b06381ae7b1
- PhishDestroy: https://phishdestroy.io/domain/web-ledgr-wallet.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/web-ledgr-wallet.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/web-ledgr-wallet.pages.dev/
Last updated: 2026-03-22