io-ledger-en-us[.]pages[.]dev

PhishDestroy identifies io-ledger-en-us.pages.dev as an active crypto drainer domain under investigation. This fraudulent site specifically mimics Ledger's official website to trick users into connecting crypto wallets and signing malicious transactions, resulting in asset theft. The threat posed is direct financial loss through unauthorized cryptocurrency transfers.

This domain shows no detections on VirusTotal (9/95 engines) as of current scans. It resolves to IP address 188.114.97.3, with SSL certification issued by Google Trust Services to provide a false sense of legitimacy. The domain is registered through Cloudflare, Inc., a common service used by threat actors to obscure hosting origins and enhance site uptime. The unique seed identifier 11d0c3 confirms consistent tracking across PhishDestroy's systems. Despite the use of Google's SSL and Cloudflare, no blocklists currently flag this domain, suggesting it may be newly deployed or designed to evade early detection.

Users should immediately avoid visiting or interacting with io-ledger-en-us.pages.dev. Never enter wallet credentials, connect wallets, or initiate transactions from links in unsolicited emails or ads claiming to be from Ledger. Verify all URLs manually by typing ledger.com directly into the browser. Enable wallet app notifications for transaction approvals and consider using hardware wallets with screen verification. Report any suspicious interactions to Ledger support and PhishDestroy’s threat intake system. If funds have been lost, file reports with local cybercrime units and blockchain forensic services immediately.