ledgr-safe[.]pages[.]dev

PhishDestroy identifies ledgr-safe.pages.dev as a crypto drainer actively impersonating Ledger hardware wallet services, with no detections on VirusTotal despite clear red flags. This domain uses Cloudflare-hosted infrastructure and a Google-issued SSL certificate to appear legitimate, but it’s designed to trick users into connecting cryptocurrency wallets under false pretenses. Given the active status and low detection rate, it poses a clear and present threat to cryptocurrency users seeking wallet support or security tools. This domain was flagged with a generic phishing threat type, showing zero detections on VirusTotal out of 95 security engines as of the latest scan. It was registered through Cloudflare, Inc., resolving to IP address 188.114.97.3, and currently hosts a spoofed Ledger wallet interface. The use of a Google Trust Services SSL certificate is a common tactic to lend false credibility to phishing sites, while Cloudflare’s infrastructure makes blocking more challenging due to rapid IP rotation and CDN masking. If you visited ledgr-safe.pages.dev or entered any wallet credentials or connected a wallet, disconnect your device from the internet immediately. Revoke any permissions granted to unknown sites via your wallet’s app or browser extension. Clear your browser cache and run a full antivirus scan. Report the domain to your antivirus provider and to Cloudflare’s abuse team. Never reuse wallet recovery phrases or private keys. Always verify URLs via official Ledger channels and use hardware wallet verification for any transaction.