wallets-leger[.]pages[.]dev

PhishDestroy identifies wallets-leger.pages.dev as an active crypto drainer impersonating Ledger wallets, currently hosting a browser-based wallet drainer payload. This fraudulent portal attempts to trick cryptocurrency users into connecting their wallets and approving malicious token approval transactions, resulting in the immediate draining of digital assets to attacker-controlled addresses. The threat is assessed as elevated due to the active deployment of a drainer script and the domain’s use of convincing Ledger branding to deceive visitors. Users who connect wallets to this service risk irreversible financial loss as assets are transferred without additional authorization.

This domain was flagged by 12 of 95 VirusTotal vendors and resolves to IP address 172.66.44.151 using a Google Trust Services SSL certificate. Registered through Cloudflare, Inc., the domain leverages Cloudflare’s infrastructure to conceal true hosting details and enhance reliability, making takedown efforts more challenging. With no publicly available creation date and a low trust score due to widespread detection, wallets-leger.pages.dev ranks poorly on blocklist transparency indices. The combination of active abuse, high-risk payload integration, and multi-vendor detection underscores its elevated threat profile.

PhishDestroy assesses this domain as active and dangerous. All cryptocurrency users, especially Ledger hardware wallet owners, should avoid interacting with wallets-leger.pages.dev or any derivative domains. Immediately block the domain at network and endpoint levels using DNS filtering or host file updates. If you have recently connected a wallet to this site, revoke suspicious token approvals via your wallet’s interface (e.g., Etherscan or wallet settings) and consider transferring remaining funds to a cold wallet. Report the domain to your security team and relevant abuse channels to prevent further victimization.