io-en-ledger-in[.]pages[.]dev

PhishDestroy identifies io-en-ledger-in.pages.dev as an active crypto drainer domain impersonating Ledger’s wallet interface. This domain employs a drainer kit designed to siphon cryptocurrency assets from unsuspecting users under the guise of a legitimate Ledger verification page. While the infrastructure leverages Cloudflare’s Pages service for hosting, the threat actor’s intent is clear: to deceive victims into connecting their wallets and approving fraudulent transactions.

Forensic analysis reveals exact threat indicators: VirusTotal flags only 1 out of 95 security vendors (1.05%), while the domain resolves to IP 188.114.97.3, operated by Cloudflare, Inc., via a Google Trust Services SSL certificate. This indicates a sophisticated evasion technique, as the certificate chain appears legitimate at first glance. The seed identifier 296b68 ties this domain to a known campaign infrastructure, suggesting reuse or shared threat actor involvement.

Current status shows active deployment with no blocklist mitigations detected at the time of analysis. Immediate actions include adding the domain and IP to corporate blocklists (DNS, firewall, proxy), and flagging the SSL certificate for inspection. Despite its elevated risk profile, this domain remains unlisted on major threat intelligence platforms, highlighting the need for proactive hunting. Remaining risk is moderate due to widespread Ledger user targeting and drainer kit efficacy, necessitating user awareness campaigns and wallet connection verification procedures.