home-led-ge--r[.]pages[.]dev

PhishDestroy identifies home-led-ge--r.pages.dev as a LIVE crypto drainer that presents a counterfeit Ledger Start login page to trick users into surrendering seed phrases and private keys. The threat level remains under_investigation while behavioral analysis confirms active fund exfiltration attempts. The page title exactly matches Ledger Start — Secure Your Crypto, reinforcing the impersonation and maximizing victim engagement. This domain should be treated as HIGH RISK until further forensic review is complete. This domain was flagged on Cloudflare Pages (registrar Cloudflare, Inc.), resolves to IP 172.66.47.130, and currently returns 0 detections out of 95 engines on VirusTotal. The SSL certificate is issued by Google Trust Services (GTS), which may lower immediate suspicion, but the combination of zero detections and active hosting indicates a fresh campaign still in its early evasion phase. No current listings on public blocklists have been observed, reinforcing the need for proactive community blocking. To mitigate exposure, users must NEVER enter seed phrases or private keys on any page reached via shortened or unfamiliar links. Instead, navigate directly to the official Ledger website via a verified bookmark or typed URL. If a suspicious page is encountered, immediately report it to PhishDestroy for rapid ingestion and distribution to blocklists. Consider revoking exposed wallet permissions and migrating assets to a new, isolated wallet if credentials may have been entered. Always cross-check domains against PhishDestroy’s live database before interacting with any crypto-related login portal.