ldgress-live[.]pages[.]dev

PhishDestroy identifies the domain ldgress-live.pages.dev as an active crypto drainer scam that leverages phishing tactics to deceive users into connecting cryptocurrency wallets or entering seed phrases. This domain resolves to IP address 188.114.97.3 and operates under a Google Trust Services SSL certificate, lending it a veneer of legitimacy. However, the absence of detections on VirusTotal (2/95 engines as of this report) underscores its stealthy nature, making it critical for users to exercise extreme caution. This domain was flagged via Cloudflare, Inc. and represents a classic “fake login” or “crypto wallet drainer” attack vector, often promoted through social engineering campaigns or malvertising. The infrastructure is hosted on Cloudflare Pages, a legitimate service repurposed by threat actors. While creation details are under further analysis, current evidence places this domain in active circulation with zero detections across major AV engines, highlighting a sophisticated evasion strategy. Security teams should monitor for traffic to this domain, especially if tied to blockchain or crypto-related user activity. If you have visited ldgress-live.pages.dev or entered any sensitive information, immediately disconnect your wallet and revoke any unauthorized permissions through your wallet interface or a trustworthy blockchain explorer. Never attempt to re-engage with this site. Forward any suspicious links to your internal threat intelligence team and use a dedicated tool like PhishDestroy for real-time URL verification. Maintain heightened scrutiny regarding unsolicited crypto-related links, particularly those hosted on .pages.dev domains.