ldger-en-shop[.]pages[.]dev

PhishDestroy identifies ldger-en-shop.pages.dev as an active crypto drainer scam masquerading as a legitimate Ledger hardware wallet retailer. This fraudulent domain is designed to trick users into connecting cryptocurrency wallets to malicious smart contracts that drain funds upon approval. Given its active status and low detection rates, this represents a high-risk threat to cryptocurrency holders, particularly those familiar with Ledger’s ecosystem.

This domain was flagged by PhishDestroy with a risk status of 'under_investigation' and carries a generic phishing threat classification. Technical analysis reveals it resolves to IP address 188.114.97.3, which is hosted through Cloudflare’s infrastructure. The domain utilizes a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate. VirusTotal currently shows 0 detections out of 95 security vendors, indicating it remains undetected by most antivirus engines. The domain was registered through Cloudflare, Inc., though specific creation date is not provided in available intelligence. The combination of low detection rates, active phishing operations, and impersonation of a major hardware wallet brand creates significant risk for cryptocurrency users.

To mitigate risks associated with this crypto drainer scam, users must immediately cease all interactions with ldger-en-shop.pages.dev and verify any similar domains through PhishDestroy’s threat intelligence platform. Cryptocurrency holders should always verify the authenticity of wallet retailers by checking official Ledger channels before making purchases. Never connect wallets to unknown websites or smart contracts, and use hardware wallets for maximum security. Enable transaction confirmation prompts on connected wallets and monitor accounts for unauthorized activity. If any interaction with this domain occurred, revoke all connected wallet permissions immediately using official wallet interfaces and consider transferring remaining funds to a secure, offline wallet. Always cross-reference suspicious domains with multiple threat intelligence sources before taking any action involving cryptocurrency.