type-start-ledgr-en-usa[.]pages[.]dev

This domain is flagged as a high-risk crypto drainer phishing portal targeting digital asset users through a fraudulent onboarding interface. Analysis indicates the site is designed to mimic legitimate cryptocurrency platforms, tricking victims into connecting wallets and authorizing transactions that result in unauthorized fund transfers. The page title, 'Secure Digital Asset Onboarding - Portal Redesign,' reinforces the deception by presenting itself as an official upgrade or verification process for digital asset services. Infrastructure analysis reveals multiple concerning indicators. The domain, type-start-ledgr-en-usa.pages.dev, is registered through Cloudflare, Inc. and was created on April 27, 2026, suggesting an attempt to appear recent or temporary. It resolves to IP address 188.114.97.3, geolocated to Cloudflare’s network in California. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing sites. The domain remains active and is currently blocked by at least one security provider. Mitigation requires immediate action from security teams and potential victims. Organizations should update web filtering rules to block the domain and its resolving IP address, 188.114.97.3, across all network perimeters. Cryptocurrency users who interacted with the site should revoke any wallet authorizations granted during the session and transfer assets to a new, secure wallet. Security teams are advised to monitor for additional domains using similar naming patterns (e.g., 'ledgr,' 'onboarding,' 'portal') registered under Cloudflare or resolving to the same IP range. Proactive threat hunting should include checking for connections to the domain in proxy logs, endpoint detection data, and DNS query records.