faq-start-ledgr-en[.]pages[.]dev

PhishDestroy identifies faq-start-ledgr-en.pages.dev as an active crypto drainer phishing domain operating at elevated risk. This campaign specifically targets cryptocurrency users by impersonating a legitimate Ledger support portal, tricking victims into connecting wallets to drain funds. The domain was first observed on Cloudflare Pages and has since been weaponized with deceptive content designed to harvest private keys or seed phrases under the guise of troubleshooting hardware wallets.

This domain resolves to IP 188.114.97.3 and hosts a fraudulent interface leveraging Google Trust Services’ SSL certificate to appear trustworthy. VirusTotal analysis reveals only 1 out of 95 security vendors currently flag this endpoint, highlighting the difficulty in automated detection. Registered via Cloudflare, Inc., the site operates under Google’s *.pages.dev subdomain service, which has been increasingly abused to host time-sensitive phishing campaigns. Although no blocklist entries were found at time of analysis, the low detection rate and SSL validation underscore the deceptive nature of this infrastructure.

Users are strongly advised to avoid interacting with any links or content from faq-start-ledgr-en.pages.dev. This threat specifically targets crypto wallet connections, so never input seed phrases or connect wallets to unfamiliar sites. Always verify URLs via trusted platforms like PhishDestroy before entering sensitive information. Enable wallet address verification prompts and use hardware wallet firmware updates from official sources only. Report this domain immediately if encountered to help disrupt ongoing campaigns.