ledger-stert[.]pages[.]dev

PhishDestroy identifies the active crypto drainer phishing domain ledger-stert.pages.dev (seed: fe6348) as a current threat targeting cryptocurrency users through brand impersonation. This domain is currently live and distributing malicious payloads designed to drain digital asset wallets under the guise of a legitimate Ledger service portal.

This domain was flagged by 1 of 95 VirusTotal vendors, registered through Cloudflare, Inc., resolving to IP 172.66.47.67, and secured with a Google Trust Services SSL certificate. While lacking a publicly documented creation date, the domain’s infrastructure and trust indicators suggest recent activation targeting unsuspecting users. The low VirusTotal detection rate (1/95) coupled with the use of Cloudflare’s infrastructure indicates an attempt to evade early detection mechanisms while leveraging legitimate-looking infrastructure.

Users are advised to immediately block access to ledger-stert.pages.dev at the network and endpoint levels. Exercise extreme caution when receiving links purporting to be from Ledger or similar hardware wallet brands—verify URLs via official channels before interaction. Ensure wallet software is updated, enable transaction simulation where available, and monitor wallet addresses for unauthorized transaction approvals. Report any suspicious activity to relevant platform security teams and consider using hardware wallet transaction display features to confirm outgoing transactions.