home-ledgr-usa[.]pages[.]dev

PhishDestroy has flagged home-ledgr-usa.pages.dev with an active generic phishing threat that appears to be a crypto drainer scam designed to siphon cryptocurrency from unwitting victims. The domain leverages Cloudflare Pages hosting under Google Trust Services’ SSL certificate, which helps it evade immediate detection while distributing malicious payloads. Given the lack of current VirusTotal detections and minimal historical blocklisting, this domain remains a low-signal, high-risk threat that requires immediate scrutiny. This domain was flagged with a risk level of under_investigation and is actively resolving to IP address 188.114.97.3. VirusTotal analysis shows 0 detections out of 95 scanners as of the latest update, indicating it is not yet widely recognized as malicious by automated defenses. It is registered through Cloudflare, Inc., which provides cloaking and anonymity layers, while the SSL certificate from Google Trust Services adds a veneer of legitimacy. The domain operates under Cloudflare Pages, a platform often abused by threat actors to rapidly deploy and discard phishing infrastructure. No known creation date or blocklist inclusion data is publicly available, further obscuring its operational timeline. To mitigate exposure to this crypto drainer scam, users should avoid interacting with any links or prompts on home-ledgr-usa.pages.dev, especially those involving cryptocurrency transactions or wallet connections. Always verify the legitimacy of domains through trusted tools like PhishDestroy before entering sensitive information or approving transactions. If already exposed, users should revoke any connected wallet permissions and transfer remaining funds to a secure, isolated wallet. Security teams should monitor IP 188.114.97.3 and associated domains for emerging patterns, and report this domain to relevant threat intelligence platforms to improve collective detection.