portfolio-ledgr-desk[.]pages[.]dev

PhishDestroy identifies portfolio-ledgr-desk.pages.dev as an active crypto drainer impersonating the Ledger hardware wallet brand. The site tricks visitors into connecting their wallets under the guise of a portfolio dashboard, at which point malicious scripts attempt to drain cryptocurrency assets without authorization. Technical analysis confirms the domain resolves to IP 188.114.97.3 and is hosted behind Cloudflare, making it harder to attribute to specific threat actors while still posing a direct financial risk to unwary users. Analysis of the infrastructure reveals concerning red flags. The domain shows zero detections out of 95 VirusTotal engines, indicating it remains under the radar of most antivirus platforms despite its malicious payload. Registered through Cloudflare, Inc., the site benefits from free SSL encryption via a Google Trust Services certificate, which adds a veneer of legitimacy often exploited by scammers to bypass browser warnings. The use of a .pages.dev subdomain under Cloudflare Pages suggests rapid deployment and potential for quick takedown evasion, a common tactic among crypto drainers operating in the wild. Users who visited portfolio-ledgr-desk.pages.dev should treat the interaction as a high-risk exposure. Disconnect any connected wallets immediately using your wallet provider’s “Disconnect” function. Revoke any token approvals via reputable tools like revoke.cash or Etherscan, and transfer remaining assets to a new wallet with a different seed phrase. Report the domain to your browser’s safe browsing program and consider rotating any reused passwords across platforms. Monitor wallets with active connections—especially those connected to this site—for unauthorized transactions. This domain remains active and should be treated as hazardous until independently verified as safe.