ledzr-com-strt-io[.]pages[.]dev

PhishDestroy identifies ledzr-com-strt-io.pages.dev as an active crypto drainer scam impersonating Ledger hardware wallet services. The domain leverages Cloudflare Pages to host a convincing fake wallet interface, luring users into connecting their cryptocurrency wallets to drain assets via a malicious smart contract. This campaign is currently active and poses a severe financial risk to cryptocurrency holders who interact with the fraudulent portal.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating it has evaded signature-based detection mechanisms. It resolves to IP 172.66.47.47, registered through Cloudflare, Inc., and operates under a Google Trust Services SSL certificate to enhance credibility. The page resides on a Cloudflare Pages subdomain (pages.dev), which is frequently abused by threat actors to rapidly deploy phishing infrastructure under the guise of legitimate services. With no current blocklist entries, this domain represents an emerging threat that may expand in scope before widespread detection occurs.

Given the absence of automated detection and the sophisticated tactics employed, users must exercise extreme caution when encountering links related to Ledger or other cryptocurrency wallets. Immediately verify any suspicious domain through PhishDestroy’s real-time scanning tool before interacting with it. Cryptocurrency holders should also enable wallet address whitelisting where possible and avoid connecting devices to untrusted networks. Blocking the IP 172.66.47.47 at the network perimeter can prevent access to the scam infrastructure. This campaign’s use of a Google-issued certificate underscores the need for users to validate SSL certificates manually and rely on reputation-based tools rather than blind trust in domain legitimacy.