ledgreapp-site[.]pages[.]dev

PhishDestroy identifies ledgreapp-site.pages.dev as an active crypto drainer impersonating Ledger wallet services, posing significant risks to cryptocurrency users. This domain was flagged for hosting a generic phishing campaign designed to trick victims into connecting their wallets to a malicious smart contract for fund theft. The threat is ongoing with a status marked as active and a risk level currently under investigation, indicating potential escalation as more intelligence is gathered.

This domain resolves to IP address 172.66.44.189 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate to appear legitimate. VirusTotal currently shows 0 detections out of 95 scanners, suggesting this threat has not yet been widely recognized by security vendors despite its active status. The domain is hosted on Cloudflare Pages, a legitimate service often abused by threat actors to rapidly deploy phishing infrastructure. Technical indicators such as the use of a crypto drainer mechanism strongly correlate with advanced phishing campaigns targeting cryptocurrency holders, particularly those with Ledger devices or users seeking wallet-related services.

To mitigate risks associated with ledgreapp-site.pages.dev, users should avoid accessing or interacting with this domain entirely. If you have previously visited this site, disconnect your wallet immediately and revoke any unauthorized smart contract permissions using tools like Revoke.cash. Always verify URLs against official sources and use browser extensions like PhishDestroy to cross-check domains before entering sensitive information. For Ledger users specifically, ensure you only use the official Ledger Live application or verified Ledger domains (ledger.com) for wallet management. Report any suspicious activity to PhishDestroy to aid in the takedown of this infrastructure.