home-ledgr-nav-log-en[.]pages[.]dev

PhishDestroy identifies home-ledgr-nav-log-en.pages.dev as an active crypto drainer posing as a Ledger login portal. This domain, registered via Cloudflare on Google Trust Services SSL, resolves to 172.66.47.109 and currently shows zero detections on VirusTotal out of 95 engines, indicating it remains under the radar despite active phishing operations. Blocklist counts remain unverified due to its recent emergence, elevating the risk for unsuspecting users.

This domain specifically targets cryptocurrency users by impersonating Ledger’s authentication interface, aiming to harvest private keys or seed phrases for wallet drain attacks. The infrastructure leverages Cloudflare Pages to host the fake portal, providing a veneer of legitimacy through Google’s SSL certificate. With no current AV detection, the threat remains undetected by most defenses, increasing the likelihood of successful compromise. Technical indicators include the IP 172.66.47.109, which may correlate with other known phishing campaigns.

If you accessed this domain, cease all wallet interactions immediately and transfer assets to a new wallet via a trusted device. Scan your system for malware and revoke any permissions granted to unknown applications. Report the domain to PhishDestroy for takedown and monitor your transaction history for unauthorized transfers. Avoid reusing passwords or seed phrases across platforms to mitigate further exposure.