public-dsktop-ledgr-live[.]pages[.]dev

This domain, public-dsktop-ledgr-live.pages.dev, is currently under investigation for active crypto drainer operations, with a confirmed risk level pending further analysis. The site specifically mimics Ledger, a well-known cryptocurrency hardware wallet brand, to deceive users into connecting their wallets or entering private keys. The threat involves unauthorized fund extraction via malicious smart contract interactions or clipboard hijacking, posing severe financial risks to unsuspecting victims. As of the latest assessment, the domain remains in an active but unclassified state, requiring immediate scrutiny to determine the full scope of its malicious infrastructure. PhishDestroy’s investigation reveals critical technical indicators associated with this domain. The SSL certificate is issued by Google Trust Services, suggesting an attempt to leverage trusted infrastructure. However, the domain is registered through Cloudflare, Inc., a common tactic among malicious actors to obscure ownership and evade detection. The domain resolves to IP address 172.66.47.43, which is linked to Cloudflare’s infrastructure—a frequent red flag for phishing and drainer operations due to its use in anonymizing malicious traffic. Notably, the domain has not yet been flagged by any of 95 VirusTotal vendors, indicating a stealthy and newly deployed attack vector. The absence of detections underscores the importance of proactive threat hunting, as signature-based detection systems may lag behind emerging threats. Additionally, the domain’s use of a `.pages.dev` subdomain—a legitimate Google Pages domain—further illustrates an attempt to blend in with benign services to bypass security filters. This domain has likely been operational for a short duration, given the lack of historical detections and the dynamic nature of such attacks. The current status of public-dsktop-ledgr-live.pages.dev remains under investigation, but the evidence strongly suggests an imminent or ongoing crypto drainer campaign targeting Ledger users. Given the domain’s infrastructure choices and zero detections on VirusTotal, it is highly probable that this is part of a larger, coordinated effort to exploit trust in cryptocurrency hardware wallets. Users are strongly advised to avoid interacting with this domain and any associated links. Security teams should implement network-level blocking for the IP address 172.66.47.43 and the domain itself. Additionally, organizations should deploy heuristic-based detection rules to identify similar domains leveraging Cloudflare or Google Pages infrastructure for malicious purposes. Immediate reporting to threat intelligence platforms and browser security vendors is recommended to accelerate the flagging process and protect potential victims.