ledzr-hrdwre-wallet[.]pages[.]dev

This domain is flagged as an elevated-risk crypto drainer, designed to siphon cryptocurrency assets by tricking users into connecting wallets to malicious smart contracts. Analysis indicates the site employs deceptive wallet connection prompts, likely mimicking legitimate decentralized application interfaces to execute unauthorized transactions. The threat type is classified as a crypto drainer due to its focus on draining wallet balances through fraudulent contract interactions. Infrastructure analysis reveals the domain was registered on September 16, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.165 (AS13335, United States). Security vendors on VirusTotal detected the domain at a rate of 9/95, indicating broad consensus on its malicious nature. The domain appears on one security blocklist (PhishDestroy) and is currently offline, though its SSL certificate (issued by Google Trust Services, WE1) remains valid. The page title, 'Suspected phishing site | Cloudflare,' suggests automated or manual takedown efforts by the hosting provider. Mitigation steps for this threat type include immediately revoking any wallet connections made to the domain and auditing transaction histories for unauthorized activity. Users should verify domain authenticity before interacting with wallet prompts, particularly those hosted on pages.dev subdomains. Organizations should block the domain and its resolving IP (172.66.44.165) at the network level, monitor for related subdomains using the seed 'd2dc35,' and educate users on recognizing crypto drainer tactics, such as unsolicited wallet connection requests or pressure to act quickly.