ledge-new-app[.]pages[.]dev

PhishDestroy identifies ledge-new-app.pages.dev as a live crypto drainer impersonating the Ledger hardware wallet ecosystem to trick users into connecting compromised wallets. The domain resolves to IP 188.114.97.3 via Cloudflare, Inc., using a Google Trust Services SSL certificate to appear legitimate. VirusTotal currently shows zero detections across 95 engines, indicating either evasion or a newly deployed threat actor toolkit. The domain is active and under active monitoring by PhishDestroy threat analysts with seed 44fac6.

Technical indicators confirm this is a brand impersonation attack designed to harvest seed phrases or private keys under the guise of a 'Ledger Ledge' wallet update. The infrastructure leverages Cloudflare’s edge network for anonymity and speed, while the valid SSL certificate lowers user suspicion. Given the zero-detection status on VirusTotal, early mitigation is critical to prevent wallet compromise and fund theft. PhishDestroy assesses this as an emerging high-risk threat with potential for rapid spread.

Users who visited ledge-new-app.pages.dev should immediately disconnect any connected wallets, revoke any granted permissions via blockchain explorers or wallet interfaces, and transfer remaining funds to a cold wallet not exposed to the incident. Do not enter any seed phrases, private keys, or recovery phrases on this domain under any circumstances. Report the domain to your wallet provider and consider using PhishDestroy’s blocklist feed to prevent future exposures. Monitor all wallet addresses linked to this domain for unauthorized transactions.