know-ledgr-walet[.]pages[.]dev

PhishDestroy identifies know-ledgr-walet.pages.dev as a newly active crypto drainer impersonating Ledger hardware wallet interfaces to harvest seed phrases and private keys. This domain leverages Cloudflare Pages to host a convincing replica of Ledger's official web wallet interface, tricking users into entering sensitive credentials under the guise of 'account verification' or 'firmware updates.' The threat actor behind this operation likely automates fund transfers the moment credentials are submitted, exploiting the irreversible nature of blockchain transactions. Initial observations confirm the domain resolves to Cloudflare's edge network (188.114.96.3), with SSL certificates issued by Google Trust Services to enhance legitimacy. Threat intelligence platforms have not yet flagged this infrastructure, leaving users vulnerable to undetected compromise. Analysis of technical indicators reveals this domain was registered through Cloudflare, Inc. with no publicly listed WHOIS privacy protection, suggesting a short-lived but high-impact campaign. The infrastructure's association with Cloudflare Pages correlates with similar campaigns targeting cryptocurrency users, where attackers exploit legitimate hosting services to evade traditional IP-based blocking. VirusTotal currently reports zero detections across 95 scanning engines, indicating the domain remains under the radar of mainstream security vendors. Given its active status and the absence of countermeasures, the risk of exposure is high, particularly for users searching for 'Ledger wallet' or related terms. The domain's recent creation further increases its potential for rapid deployment across phishing channels like social media and fraudulent ads. Organizations and individuals must treat know-ledgr-walet.pages.dev as a critical threat and immediately block access at the network level. Users who visited this domain should assume their Ledger credentials may have been compromised and revoke wallet access via Ledger Live's 'Manage Devices' feature. Perform a factory reset on the physical device and generate new seed phrases, storing them offline in a secure location. Monitor on-chain transactions for unauthorized transfers, and report any suspicious activity to Ledger's official support channels. Enable multi-factor authentication on all exchange accounts and consider migrating assets to cold storage if warm wallets were previously used. Security teams should update firewall rules to block the IP (188.114.96.3) and domain, while conducting phishing awareness training to highlight the dangers of non-official wallet interfaces.