en-us-setup-ledger[.]pages[.]dev

en-us-setup-ledger.pages.dev is an active crypto-drainer phishing domain designed to deceive users into unknowingly transferring cryptocurrency assets to attacker-controlled wallets. Security researchers identified this domain as part of a sophisticated phishing campaign targeting users with fraudulent 'Ledger wallet setup' pages hosted on pages.dev, a legitimate Cloudflare Pages domain abused for hosting malicious content. The threat actor behind this operation leverages social engineering tactics, such as impersonating official Ledger documentation or setup guides, to trick victims into connecting their wallets or entering seed phrases. Once connected, the crypto drainer silently siphons assets from the victim's wallet without their knowledge, often exploiting vulnerabilities in wallet integrations or deceiving users into approving malicious transactions. PhishDestroy's seed-based analysis (8ad492) confirms this domain is actively engaged in draining operations, with infrastructure designed to evade early detection mechanisms.

Technical analysis of en-us-setup-ledger.pages.dev reveals several red flags that align with crypto-draining operations. The domain resolves to IP 172.66.44.252, which is part of Cloudflare's infrastructure, though the hosting service (pages.dev) is being abused for malicious purposes. The domain holds a valid SSL certificate issued by Google Trust Services, a tactic used to appear legitimate and bypass browser warnings. VirusTotal currently shows 0 detections out of 95 scanning engines, highlighting how these domains often fly under the radar until manual analysis or broader reporting occurs. Additionally, the domain is registered through Cloudflare, Inc., which is not inherently suspicious but is frequently exploited by threat actors due to Cloudflare's legitimate services being repurposed for malicious hosting. The combination of a crypto-drainer payload, evasion techniques, and lack of detections underscores the high-risk nature of this domain.

Users who have visited en-us-setup-ledger.pages.dev should take immediate action to secure their cryptocurrency assets. First, disconnect any wallets or applications that may have been connected to this domain, as malicious scripts may still be running in the background. Next, revoke any permissions granted to suspicious or unfamiliar websites or applications, particularly those related to wallet integrations or cryptocurrency transactions. If any transactions were approved while connected to this domain, monitor your wallet activity closely and report unauthorized transactions to your wallet provider or exchange immediately. Additionally, scan your device for malware or browser extensions that may have been installed without your consent, as these could facilitate further unauthorized access. To prevent future exposure, avoid clicking on unsolicited links or advertisements related to cryptocurrency setups or wallet configurations. PhishDestroy advises treating en-us-setup-ledger.pages.dev as hostile and blocking it at the network level if possible.