ledgerrcom--start--eng[.]pages[.]dev

PhishDestroy identifies ledgerrcom--start--eng.pages.dev as a live crypto-drainer site masquerading as a Ledger wallet startup page. When visited, the page loads a convincing impersonation aimed at tricking users into connecting their wallets and signing malicious transactions that silently drain cryptocurrency funds. The domain is hosted on Cloudflare Pages and resolves to 172.66.47.198, protected by a Google Trust Services SSL certificate. This domain was flagged with 0 detections on VirusTotal out of 95 engines as of the latest scan, indicating it remains undetected by most antivirus systems. Registered through Cloudflare, Inc., the domain shows recent activity with no long-standing reputation. Its structure—ledgerrcom--start--eng.pages.dev—uses multiple hyphens and subdomain segments to mimic official branding and bypass simple blocklists. If you have visited this domain, do not approve any wallet connection requests or transaction confirmations. Disconnect your wallet immediately and revoke any unauthorized permissions via your wallet’s settings. Report the domain to your security team and share this advisory with colleagues to prevent further exposure. Monitor your wallet and transaction history for any unauthorized transfers.