guide-desktop-en-us-ledgr-x[.]pages[.]dev

PhishDestroy identifies guide-desktop-en-us-ledgr-x.pages.dev as an active crypto drainer page hosted on Cloudflare Pages. No specific brand is being impersonated in the observed payload, suggesting this is a generic drainer kit deployed under a deceptive subdomain. The page leverages Cloudflare’s infrastructure to redirect users or inject malicious scripts, likely targeting cryptocurrency wallet connections or seed phrase harvesting. The domain resolves to IP 172.66.44.199 and is served via a Google Trust Services SSL certificate, evading initial trust checks. As of the latest scan, VirusTotal shows 4/95 detections, indicating it remains under the radar. Registered through Cloudflare, Inc., this domain is part of a broader campaign using Pages.dev subdomains to host malicious content while maintaining operational agility. Google Safe Browsing has not yet flagged it, and current blocklist counts remain at zero. The threat is currently active with a risk level marked as under_investigation, implying escalation is pending further behavioral analysis. Immediate actions include blocking the domain at the network perimeter and updating endpoint rules to flag similar Pages.dev subdomains. While the low detection rate suggests novelty, the use of a crypto drainer kit elevates the risk of financial theft. Users should avoid interaction and report any observed activity to SOC teams for further IOC enrichment.