support-ledge-news[.]pages[.]dev

PhishDestroy identifies support-ledge-news.pages.dev as an active crypto drainer scam site designed to trick users into connecting wallets under the guise of a 'support portal' for crypto services. The domain abuses legitimate Cloudflare Workers hosting (pages.dev) to host its malicious infrastructure, leveraging Google Trust Services SSL certificates to appear legitimate. Threat actors commonly use such domains in social engineering campaigns targeting cryptocurrency users, often impersonating customer support for popular exchanges or protocols to trick victims into approving malicious transaction requests that drain funds from connected wallets. The domain was registered through Cloudflare, Inc., and resolves to IP 172.66.47.21, which hosts the malicious content under the disguise of a news or support page. This domain was flagged by Google Safe Browsing with a SOCIAL_ENGINEERING classification, indicating active deception tactics. VirusTotal scanning at the time of analysis shows 12/95 security vendors detecting the threat, highlighting a critical gap in automated detection for this campaign. The domain's recent deployment and reliance on legitimate infrastructure providers like Cloudflare and Google Trust Services make it particularly deceptive and capable of bypassing traditional security measures. The combination of low detection rates, impersonation tactics, and abuse of reputable services places this domain at a high risk for crypto users who may interact with it unknowingly. Users who visited support-ledge-news.pages.dev should immediately disconnect any connected wallets and revoke any approved permissions or transactions. Do not interact with wallet connection prompts or transaction requests if you landed on this domain. Clear browser cache and cookies associated with the domain, and consider using tools like wallet permission managers (e.g., Revoke.cash) to audit and revoke suspicious approvals. Report the domain to your browser's safe browsing tools and consider notifying relevant crypto platforms or communities if you suspect exposure to this scam. Always verify support channels directly through official websites or trusted communication methods before engaging.