pro-ledegr[.]pages[.]dev

PhishDestroy identifies pro-ledegr.pages.dev—a Cloudflare Pages domain currently active and under investigation—as a crypto drainer impersonating a login interface likely targeting cryptocurrency users. This deceptive page, resolving to ASN 13335 at 188.114.97.3, has yet to be flagged by VirusTotal engines (5/95 detections), raising concern about delayed detection times on traditional scanners. The domain’s SSL certificate, issued by Google Trust Services, gives it an air of legitimacy, while its use of Cloudflare’s infrastructure complicates rapid takedown efforts. Domain specifics align with reconnaissance-heavy threat operations. Registered through Cloudflare, Inc., the domain leverages Pages—a platform often exploited to host spoofed login portals with minimal friction. With no blocklist detections yet recorded, the window of exposure remains open, emphasizing the need for proactive analysis. The infrastructure (188.114.97.3) resides within Cloudflare’s global network, a common refuge for malicious actors seeking evasion from IP-based blocking. Users who visited pro-ledegr.pages.dev should immediately cease any interaction and assume potential credential exposure or crypto wallet compromise. Activate account recovery procedures on all associated platforms, enable two-factor authentication, and revoke any recently authorized permissions—especially those linked to cryptocurrency platforms. Submit this domain and any entered credentials to PhishDestroy for verification and remediation guidance to prevent further exploitation.