leger-com-start-app-6yx[.]pages[.]dev

PhishDestroy identifies the domain leger-com-start-app-6yx.pages.dev as an active phishing threat under investigation, currently classified as a generic phishing attack. This domain mimics legitimate cryptocurrency wallet services, likely targeting users of Ledger hardware wallets under the guise of a startup application. The fraudulent site remains accessible and operational as of the latest assessment.

This domain was flagged by 8 of 95 VirusTotal vendors, indicating it has not yet been widely detected by security tools despite its malicious intent. Registered through Cloudflare, Inc., the site resolves to IP address 172.66.47.24 and operates under a Google Trust Services SSL certificate, adding a veneer of legitimacy. The phishing page leverages Cloudflare Pages to host its deceptive content, exploiting the platform’s reputation to evade early detection. Security telemetry suggests this is a low-volume, targeted campaign rather than a widespread blast.

The threat remains active, with no confirmed takedown as of the latest assessment. Users who encounter this domain should avoid interacting with it entirely—do not click links, download files, or enter any credentials. If you accessed this page by mistake, check your device for unauthorized transactions or installed malware. Report the domain to your antivirus provider and consider blocking 172.66.47.24 at the network level. Always verify crypto wallet URLs by typing them manually or using official bookmarks—never rely on links from emails or third-party sites.