ldgerres-live[.]pages[.]dev

PhishDestroy identifies the domain ldgerres-live.pages.dev as an active crypto drainer that silently siphons funds from connected wallets the moment victims authorize malicious token contracts. The site mimics legitimate crypto-services to trick users into granting unlimited spend approvals, which the attacker then exploits to drain stable-coins, NFTs, and other assets without further prompts. Any transaction signed after visiting this page could trigger an irreversible transfer to wallets controlled by the threat actor, leaving victims with empty balances in minutes. This domain was flagged by PhishDestroy on seed 50cc2e and is currently resolving to IP 172.66.44.135 via Cloudflare’s infrastructure. The attacker leveraged Google Trust Services for an SSL certificate to appear legitimate, yet VirusTotal still shows 0 detections out of 95 scanners as of the latest crawl, indicating the page remains undetected by most automated defenses. Registrar data and certificate issuance point to recent setup tactics designed to evade early detection. If you visited ldgerres-live.pages.dev, disconnect your wallet immediately and revoke any token approvals through reputable tools like revoke.cash or Rabby’s built-in revoke feature. Do NOT sign any additional transactions or approve new contracts from this site. Report the incident to PhishDestroy using the seed “50cc2e” and consider rotating wallet addresses if you interacted with the page at all. Monitor your transaction history for unauthorized transfers and contact your wallet provider for further guidance.