ledger-wallet--auth[.]pages[.]dev

PhishDestroy identifies ledger-wallet--auth.pages.dev as an active crypto-draining site that masquerades as the legitimate Ledger login portal. Visitors who enter credentials or connect a wallet are at risk of immediate fund theft, as the domain silently drains tokens via malicious smart-contract prompts. Security telemetry shows this infrastructure is engineered to harvest seed phrases or private keys under the guise of a security update or authentication challenge. Users should treat this domain as hostile and avoid any interaction. This domain was flagged by 11 of 95 VirusTotal engines and resolves to IP 172.66.44.177. It was registered recently through Cloudflare, Inc., leveraging the Pages.dev sub-domain service to appear benign. The combination of low detection rate and Cloudflare fronting is a common tactic to bypass initial network filters and prolong campaign lifespan. Historical pivoting of this seed (3adf74) reveals similar clusters targeting crypto wallets within the last 90 days. If you already visited this site, disconnect any connected wallets immediately, revoke any token approvals via etherscan.io or equivalent, and generate new seed phrases for any affected accounts. Do NOT enter any recovery phrases or private keys on this domain. Run a malware scan on local devices to check for infostealer infections. Report the domain to your wallet provider and PhishDestroy for takedown. Stay vigilant—legitimate Ledger communications only occur through verified channels such as official email domains (e.g., ledger.com) and the Ledger Live application.