homepage-ledger-en[.]pages[.]dev

PhishDestroy identifies homepage-ledger-en.pages.dev as an active crypto drainer domain under investigation, designed to impersonate the legitimate Ledger Live cryptocurrency wallet interface. This threat specifically targets cryptocurrency users by tricking them into revealing sensitive wallet credentials or authorizing malicious transactions via a spoofed Ledger interface. The domain employs a multi-layered obfuscation strategy, leveraging reputable infrastructure to avoid immediate detection while maintaining operational flexibility. homepage-ledger-en.pages.dev shows 3 out of 95 VirusTotal detections as of latest scan, indicating it remains undetected by mainstream security vendors. The domain is registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3, which has been associated with malicious cryptocurrency-related activities. The SSL certificate is issued by Google Trust Services, adding a false layer of legitimacy to phishing attempts. This domain is hosted on Cloudflare Pages, a legitimate service often abused for phishing campaigns due to its fast deployment and built-in DDoS protection. Users must treat this domain as HIGH RISK and avoid any interaction involving cryptocurrency operations. The crypto drainer threat here involves either tricking users into entering their seed phrases on a fake Ledger Live interface or prompting wallet connections that authorize transaction signing to attacker-controlled addresses. Immediate mitigation includes blocking the domain at network level, clearing browser cache and cookies related to Ledger services, and using hardware wallets in isolated network environments. Always verify URLs through official Ledger channels and never input seed phrases outside of a completely offline, hardware wallet device. Report this domain to security teams via PhishDestroy's database for further analysis and potential takedown requests.