nav-us-ledgors-starts[.]pages[.]dev

This domain, nav-us-ledgors-starts.pages.dev, is under investigation for hosting a crypto wallet drainer phishing scheme. Analysis of the page title, "Secure Digital Assets: A Comprehensive Guide to Getting Started," suggests an attempt to deceive users into interacting with malicious smart contracts or fake wallet interfaces designed to siphon cryptocurrency. No specific brand impersonation is evident, but the content aligns with known drainer kit tactics, including social engineering to prompt wallet connections or seed phrase disclosures. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 0/95, indicating no current antivirus engine flags. The domain is registered through Cloudflare, Inc., and resolves to IP address 188.114.97.3, hosted in Canada under Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-managed domains. The domain was created on April 27, 2026, and appears on one security blocklist. Google Safe Browsing status is not explicitly stated, but the domain remains unflagged by most security vendors. Current status is active, with no takedown or sinkholing observed. The domain has been blocked by at least one security provider, but the lack of broader detection suggests either recent deployment or evasion techniques. Remaining risk includes potential exposure for users misled by the deceptive content, particularly those searching for cryptocurrency guides or wallet setup instructions. Recommended actions include monitoring for additional blocklist inclusions, analyzing the domain’s hosting content for embedded JavaScript or smart contract interactions, and alerting cryptocurrency communities to avoid engagement. Further investigation into the IP and certificate associations may reveal additional linked phishing infrastructure.