ldgur-start[.]pages[.]dev

PhishDestroy identifies ldgur-start.pages.dev as an active crypto-drainer domain under investigation for credential theft and asset exfiltration. The domain leverages Cloudflare Pages hosting to deliver a JavaScript-based drainer kit that targets cryptocurrency wallet signatures and private-key extraction attempts. Behavioral analysis indicates real-time clipboard and transaction simulation attacks, with redirection chains observed to decoy Ethereum and Solana wallet interfaces. No confirmed brand impersonation payload has been isolated yet, suggesting a generic drainer deployment rather than a targeted brand abuse campaign.

Technical indicators confirm low detection hygiene: VirusTotal shows 7/95 detections on the live URL, indicating zero sandbox or AV coverage as of seed 618417. The domain resolves to IP 172.66.45.24 via Cloudflare, Inc., with a Google Trust Services SSL certificate issued for pages.dev wildcard scope. WHOIS data reveals a recent creation date within the last 7 days, and Google Safe Browsing (GSB) has not yet flagged the domain. Current VirusTotal blocklist integration indicates 0 security vendors have added detections, and passive DNS shows no historical association with known drainer infrastructure.

This domain remains ACTIVE with status UNDER_INVESTIGATION and presents a HIGH RISK to cryptocurrency users engaging with the page. Immediate action is required: block the domain at DNS and network layers, flag all associated IPs and SSL certificates, and alert wallet providers to implement signature simulation warnings. Users are advised to avoid visiting ldgur-start.pages.dev and to revoke any recently signed transactions involving this domain. Monitoring is ongoing for payload updates, and further forensic extraction is in progress to identify the exact drainer kit variant and exfiltration endpoints.