downld-ledgr-lives[.]pages[.]dev

PhishDestroy has flagged downld-ledgr-lives.pages.dev as an active crypto drainer, a type of phishing site designed to trick users into connecting cryptocurrency wallets under false pretenses. The domain mimics legitimate services, likely targeting users expecting secure downloads or financial integrations. Once a victim connects their wallet, the site may drain tokens by exploiting smart contract approvals or fake transaction prompts. This behavior is part of a growing trend where attackers abuse cloud platforms like Google Pages to host malicious content under the guise of professional tooling. This domain resolves to IP 188.114.97.3 and operates under a Google Trust Services SSL certificate, leveraging Cloudflare’s infrastructure for hosting. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating it has evaded current signature-based detection. The domain was registered through Cloudflare, Inc., and appears to be actively leveraging Pages.dev, a legitimate service repurposed for malicious intent. While the SSL certificate provides a veneer of legitimacy, the absence of detections suggests this is a newly deployed or carefully crafted threat. If you visited downld-ledgr-lives.pages.dev, disconnect your wallet immediately and revoke any suspicious approvals via tools like revoke.cash or your wallet’s interface. Do not interact with pop-ups or prompts, even if they appear urgent. Clear your browser cache and run a scan with trusted security software. Report the domain to your wallet provider and consider monitoring your accounts for unauthorized transactions. Always verify domains via official channels before interacting, especially when dealing with cryptocurrency.