start-en--ledger-io[.]pages[.]dev

PhishDestroy identifies start-en--ledger-io.pages.dev as an active crypto drainer posing as a legitimate Ledger service page. This domain employs deceptive branding to trick users into connecting cryptocurrency wallets and authorizing malicious transactions that drain assets. The page mimics Ledger's official website structure through the use of Cloudflare Pages, leveraging the trusted .pages.dev subdomain to appear legitimate at first glance. Technical indicators confirm this domain was registered through Cloudflare, Inc. and operates under a Google Trust Services SSL certificate, which may further enhance its credibility. The domain resolves to IP 172.66.47.142 and currently shows 0 detections out of 95 VirusTotal scans, indicating it has not yet been widely flagged by security vendors. While the precise registration date remains undisclosed, the active status of the crypto drainer infrastructure suggests recent deployment aimed at exploiting unsuspecting cryptocurrency users. Users who have visited this domain should immediately disconnect their wallets and revoke any unauthorized permissions granted to the site. Performing a full wallet reset and checking transaction history for suspicious activity is strongly advised. Report the domain to your security team and block it at the network level to prevent further access. Remain vigilant for similar impersonation attempts and verify website URLs through official communication channels before interacting with cryptocurrency services.