live-ledge-learns.pages.dev — Crypto Drainer Phishing Report

PhishDestroy identifies live-ledge-learns.pages.dev as a live crypto drainer phishing domain impersonating a generic educational claim to deceive users into connecting crypto wallets. The domain presents a fraudulent landing page designed to harvest private keys or initiate unauthorized transactions under the guise of a 'learning platform.' While no specific brand is directly mimicked in the sample intelligence, the tactic aligns with common crypto drainer kits that leverage urgency ('learn now') and perceived legitimacy through legitimate infrastructure (Cloudflare Pages, Google Trust Services SSL) to bypass user skepticism and browser-based defenses.

This domain resolves to IP 172.66.47.172 and is registered through Cloudflare, Inc., hosting a certificate issued by Google Trust Services. VirusTotal detection stands at just 1 out of 95 security vendors as of current analysis, indicating low initial detection despite active malicious hosting. The domain was created recently via Cloudflare Pages, a platform often abused for fast-turnaround phishing due to its free tier, automated CI/CD, and trusted SSL issuance. There is no indication this domain has been processed by Google Safe Browsing (GSB) at the time of this report, and no data is available on third-party blocklist inclusion, suggesting a window of opportunity for propagation.

The campaign is currently active and in early-stage propagation, leveraging high-reputation infrastructure to evade immediate detection. Immediate response includes blocking the domain at DNS and network levels, flagging the IP 172.66.47.172, and updating browser and extension-based security lists. Users should avoid interacting with any links or QR codes associated with this domain, especially those promoting 'crypto learning' or 'wallet connection.' Remaining risk is elevated due to low detection, legitimate-looking infrastructure, and active hosting. Organizations are advised to inspect outbound traffic for connections to this domain and audit endpoint logs for wallet drainer signatures or unusual process execution.