begin-walet-ledgrelive[.]pages[.]dev

PhishDestroy identifies begin-walet-ledgrelive.pages.dev as an active crypto drainer phishing domain masquerading as a legitimate wallet login page. The page is part of a broader campaign targeting users who may mistake it for an authentic cryptocurrency service, aiming to trick visitors into entering sensitive wallet credentials or authorizing malicious transactions. This domain was flagged by our SOC team after resolving to 172.66.44.201 with zero detections on VirusTotal across 95 engines. The domain is registered through Cloudflare, Inc., which provides anonymity and rapid infrastructure provisioning often exploited by malicious actors. The SSL certificate is issued by Google Trust Services, a tactic commonly used to lend false credibility to phishing sites. The page resides on Cloudflare Pages, leveraging a legitimate platform to host malicious content under the guise of a wallet service. If you visited begin-walet-ledgrelive.pages.dev, stop any ongoing transactions or wallet connections immediately. Disconnect your device from the internet, run a full antivirus scan, and inspect your wallet’s transaction history for unauthorized transfers. Consider revoking any connected app permissions and rotating your wallet credentials if you entered them. Report the domain to your security team and avoid interacting with similar URLs in the future.