ledgerstart--com[.]pages[.]dev

PhishDestroy identifies ledgerstart--com.pages.dev as an active crypto drainer impersonating Ledger’s brand ecosystem. This domain leverages Cloudflare Pages to host malicious scripts designed to intercept and divert cryptocurrency transactions to attacker-controlled wallets. The threat actor registered the domain through Cloudflare, Inc. and secured it with a Google Trust Services SSL certificate, increasing its perceived legitimacy. Resolved to IP 172.66.44.125, the domain remains undetected on VirusTotal with 8/95 security engines flagging it as of current analysis. This domain was flagged under investigation due to its involvement in a crypto drainer campaign targeting users of digital asset platforms. The malicious infrastructure is designed to scrape wallet connection requests and manipulate transaction parameters, enabling unauthorized transfers without user consent. Analysis confirms the domain is part of a seed-based campaign identified by unique seed 4f5326, indicating coordinated deployment across multiple domains. Despite zero detections on VirusTotal, its active status and association with known drainer toolkits warrant immediate caution. Users who visited ledgerstart--com.pages.dev should assume their browser or device may have been compromised. Disconnect from the internet, close all browser tabs, and scan for malware using a reputable antivirus tool. Revoke any active wallet connections via your wallet’s official interface and consider transferring remaining funds to a newly generated, offline wallet. Report the domain to your antivirus provider and relevant cybercrime authorities to aid in global threat intelligence sharing.