access-ledgrrliv-wallet-us[.]pages[.]dev

The domain access-ledgrrliv-wallet-us.pages.dev is identified as a crypto drainer phishing site and is currently offline. Analysis indicates that this domain poses an elevated risk due to its purpose and the presence of multiple threat indicators. The domain is suspected of impersonating a legitimate cryptocurrency wallet service, which could lead to the theft of private keys and other sensitive information.

Infrastructure analysis reveals that the domain is hosted by Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is located in the United States and managed by AS13335 Cloudflare, Inc. The SSL certificate for the domain is issued by Google Trust Services / WE1, which adds a layer of perceived legitimacy. The domain was created on September 02, 2020, and as of the latest assessment, it has been flagged by 18 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, specifically PhishDestroy. These findings suggest a concerted effort to deceive users by mimicking a trusted service while leveraging reputable infrastructure.

Given the current status of the domain as offline, the immediate threat is mitigated. However, the domain's history and the specific threat it posed as a crypto drainer require ongoing monitoring. Recommendations include adding this domain to internal blocklists and educating users about the risks associated with phishing sites that impersonate cryptocurrency services. Organizations should also implement multi-factor authentication and regularly audit digital assets for any signs of unauthorized access or activity.