ledggrr-start[.]pages[.]dev

PhishDestroy identifies ledggrr-start.pages.dev as an active cryptocurrency drainer domain designed to trick users into connecting wallets and approving malicious transactions. The site mimics legitimate crypto-dashboard interfaces to harvest private keys or drain tokens under the guise of balance checks or transaction previews. Security researchers have documented rapid proliferation of similar crypto-drainers hosted on Cloudflare Pages subdomains, often leveraging free tiers to bypass initial detection. This domain was flagged through automated behavioral analysis detecting wallet-connect prompts and token-approval simulation flows.

Technical indicators confirm this is a newly emerged threat. The domain was registered via Cloudflare, Inc., resolving to IP 188.114.97.3 with a Google Trust Services SSL certificate issued for phishing-resistant domains. VirusTotal currently shows zero detections across 95 scanning engines, indicating it remains under the radar of traditional antivirus platforms. While the registrar and SSL provider are legitimate entities, the subdomain hosting method and zero-detection status create a blind spot attackers exploit to harvest crypto funds within hours of deployment.

If you visited ledggrr-start.pages.dev, immediately revoke any wallet connections through your wallet’s connection manager and check transaction history for unauthorized approvals. Do not interact with any prompts asking for seed phrases or private keys. Report the domain to PhishDestroy using the unique seed f013d7 so our crawlers can accelerate takedown requests. Use hardware wallets for high-value assets and enable transaction simulation warnings to prevent silent token approvals.