start-ldgger--en[.]pages[.]dev

PhishDestroy flags start-ldgger--en.pages.dev as an active crypto drainer phishing domain impersonating Ledger Live, a widely recognized hardware wallet provider. The domain leverages a spoofed branding strategy to trick users into connecting their wallets under the guise of an official Ledger service. While the specific drainer kit remains undetected in open-source intelligence, the page structure and payload delivery mechanism align with established crypto-draining campaigns, which typically exfiltrate wallet credentials, private keys, or initiate unauthorized transactions upon user interaction.

Technical indicators confirm this domain’s malicious potential. Resolving to IP 188.114.97.3, the domain is hosted on Cloudflare, Inc. infrastructure and secured with a Google Trust Services SSL certificate to enhance legitimacy. VirusTotal currently returns 2/95 detection ratios, indicating no immediate blacklisting by major antivirus engines. The domain’s creation date and additional blocklist memberships remain undisclosed, though its use of Cloudflare’s pages.dev subdomain suggests a recent registration aimed at evading traditional detection methods. The combination of a trusted SSL certificate and Cloudflare hosting creates a deceptive facade that may bypass casual scrutiny.

This domain remains active as of the latest analysis, with no confirmed takedown or response actions by hosting providers or security vendors. Given the absence of detections and the high-risk nature of crypto drainers, PhishDestroy retains an 'under_investigation' status while monitoring for behavioral shifts. Users are strongly advised to avoid interacting with any links associated with this domain and to verify URLs using PhishDestroy’s database or other reputable threat intelligence platforms. The remaining risk is moderate-to-high due to the domain’s current evasion of detection systems and reliance on social engineering tactics to compromise cryptocurrency funds.