eng-ledger-page[.]pages[.]dev

PhishDestroy identifies eng-ledger-page.pages.dev as an active crypto drainer campaign distributing malicious wallet-draining scripts under the guise of a financial ledger interface. This domain leverages Cloudflare Pages to host a deceptive portal designed to trick users into connecting wallets and approve fraudulent transactions, resulting in asset theft. The threat actor behind this campaign exploits low detection rates and reputable infrastructure to evade early discovery by security solutions. This domain exhibits multiple indicators consistent with a high-risk crypto drainer. VirusTotal analysis confirms 9/95 detections across major antivirus engines as of the latest scan, indicating it remains undetected by conventional security measures. The domain is registered through Cloudflare, Inc., and resolves to IP address 172.66.47.73, with a valid SSL certificate issued by Google Trust Services—factors that enhance its legitimacy in user and automated scanner perception. While the exact creation date is not provided in public data, the absence of detections and active hosting on a trusted CDN platform strongly suggest this campaign is currently operational and evolving rapidly. Users who have accessed this domain should immediately disconnect any connected wallets, revoke any unauthorized transaction approvals via blockchain explorers such as Etherscan or BscScan, and perform a full system scan using updated antivirus software. If crypto assets have been transferred or approved for malicious contracts, file an incident report with your wallet provider and local cybercrime units. Disable JavaScript in browser settings when accessing DeFi platforms as a precaution, and avoid clicking on unsolicited links or redirected pages claiming to offer financial tools. Block the domain and related IP at the firewall level to prevent future exposure. Always verify domain authenticity and use hardware wallets for high-value transactions to mitigate risk.