hardwre-ldger[.]pages[.]dev

PhishDestroy identifies hardwre-ldger.pages.dev as an active crypto drainer scam masquerading as the official Ledger Live interface. The domain uses a homoglyph attack, replacing the letter 'a' with 'e' (hardwre vs hardware), a common tactic to deceive users into believing they are accessing legitimate Ledger services. The site is configured to intercept and drain cryptocurrency assets from connected wallets, likely leveraging a drainer kit such as Angel Drainer or Inferno Drainer, which are frequently deployed in such campaigns to automate fund extraction. hardwre-ldger.pages.dev resolves to IP 172.66.47.162, a Cloudflare-hosted address registered through Cloudflare, Inc. The domain utilizes a Google Trust Services SSL certificate, which is often abused to lend false legitimacy to scam sites. VirusTotal currently shows 11/95 detections, indicating no immediate flagging by antivirus engines, despite its malicious nature. The domain is newly active, with no historical blocklist presence, making it a high-risk, low-detection threat vector ideal for targeting cryptocurrency users. This domain remains active at the time of writing, with no intervention observed from hosting providers or security vendors. Users are strongly advised to avoid interacting with the site and to verify any suspicious links through PhishDestroy’s real-time scanning tool. The remaining risk is classified as high due to the domain’s ongoing availability, lack of detections, and the irreversible nature of cryptocurrency theft. Immediate takedown requests have been recommended to Cloudflare, but no confirmations have been received.