ledgerlogn-us[.]pages[.]dev

PhishDestroy identifies ledgerlogn-us.pages.dev as an active crypto drainer impersonating Ledger hardware wallets, currently under investigation by cybersecurity analysts. This domain leverages Google Trust Services SSL certificates and Cloudflare infrastructure to host malicious payloads designed to siphon cryptocurrency assets from unsuspecting users. The threat actor behind this domain employs deceptive tactics, including the use of a legitimate-looking subdomain (ledgerlogn-us) and Pages.dev hosting to evade detection by traditional security measures. As of the latest analysis, this domain remains unresolved, with no confirmed blocklist entries despite its malicious intent.

This domain was flagged by 1 of 95 VirusTotal vendors, indicating a low detection rate despite its active status. It resolves to IP address 172.66.46.230 and is registered through Cloudflare, Inc., leveraging the company’s infrastructure for anonymity and evasion. The domain’s SSL certificate is issued by Google Trust Services, further complicating detection efforts for users who rely on certificate validation as a security indicator. The unique seed identifier for this domain is 7c34f4, which aligns with other known crypto drainer campaigns. While no historical blocklist data is available, the combination of low VirusTotal detections, Cloudflare hosting, and the use of a legitimate Pages.dev domain suggests an emerging or evolving threat vector.

Given the active status of ledgerlogn-us.pages.dev and its association with crypto drainer activity, PhishDestroy recommends immediate caution for users who encounter this domain. Do not interact with the site, enter any credentials, or connect cryptocurrency wallets. Verify the legitimacy of any Ledger-related communications or websites by consulting official sources, such as the Ledger support portal or PhishDestroy’s threat database. Users who have already interacted with this domain are advised to revoke any connected wallet permissions, transfer assets to a secure wallet, and monitor for unauthorized transactions. Security researchers are encouraged to report additional findings to PhishDestroy to improve collective threat intelligence and detection capabilities.