welcome-ledgra-cdn[.]pages[.]dev

PhishDestroy identifies the domain welcome-ledgra-cdn.pages.dev as an active crypto drainer impersonating the Ledger hardware wallet brand. The threat is currently under investigation but remains in active circulation. This campaign is designed to deceive cryptocurrency users by offering fake Ledger device giveaways, with the ultimate goal of stealing their digital assets through malicious wallet addresses or fake claim pages.

This domain was flagged by 12 of 95 VirusTotal vendors as of the latest scan, indicating that it currently evades most automated detection systems. It resolves to IP address 172.66.47.196, registered through Cloudflare, Inc., a known reverse proxy and content delivery service often exploited in phishing campaigns to obfuscate origin. The domain’s SSL certificate is issued by Google Trust Services, which, while legitimate, does not guarantee the safety of the hosted content. Notably, the domain is newly registered, suggesting recent deployment, and shows no presence on major threat intelligence blocklists at this time.

Given the active status and the specific threat of crypto asset theft, PhishDestroy advises immediate avoidance of this domain and any associated links or advertisements promoting 'Ledger giveaways'. Users who have already interacted with this page are urged to revoke any wallet connections, transfer funds to a secure wallet, and scan their devices for malware. Organizations should consider blocking this domain at the network level using the IP address 172.66.47.196 and the domain name welcome-ledgra-cdn.pages.dev. Continuous monitoring of wallet addresses linked to this campaign is recommended, as crypto drainers frequently reuse addresses across victims. Report any encounters to PhishDestroy or relevant cybersecurity authorities to aid in takedown efforts and improve collective defense.