ledgrr-io-en-start[.]pages[.]dev

PhishDestroy identifies ledgrr-io-en-start.pages.dev as a live crypto drainer campaign impersonating Ledger hardware wallet services. This domain masquerades as a legitimate Ledger enrollment portal to trick users into connecting compromised cryptocurrency wallets. Upon access, victims may unknowingly sign malicious transactions that drain digital assets directly from their wallets. Security analysts note the use of Cloudflare Pages to host content, leveraging Google Trust Services SSL to appear authentic while bypassing traditional email filters. This domain was flagged with 0 detections on VirusTotal (as of seed f7ff61) across 95 scanning engines, suggesting a newly deployed and undetected campaign. Registered through Cloudflare, Inc., the domain resolves to IP 172.66.44.85 and operates via the pages.dev subdomain platform. While under active investigation, it currently remains unblocked by major threat intelligence feeds. The absence of detection underscores the importance of real-time behavior-based monitoring and user vigilance in identifying subtle impersonation attempts. If you have visited ledgrr-io-en-start.pages.dev, disconnect any connected crypto wallets immediately. Do not approve any pending transactions. Clear browser cache and cookies, and run a full antivirus scan. Report the domain to your wallet provider and consider revoking any suspicious smart contract approvals. Stay alert for follow-up phishing attempts—crypto drainers often re-engage victims with fake support or recovery emails. Always verify URLs through official Ledger channels before entering sensitive information.