start-ledgrer--com[.]pages[.]dev

PhishDestroy identifies start-ledgrer--com.pages.dev as a malicious crypto wallet scam designed to steal cryptocurrency credentials and funds from unsuspecting users. This domain employs spoofed branding to mimic legitimate crypto wallet interfaces, tricking victims into entering sensitive recovery phrases or private keys. The threat actor leverages Cloudflare Pages for hosting to evade detection and maintain uptime, while the Google Trust Services SSL certificate adds a false sense of legitimacy to the fraudulent site. Users who interact with this domain risk immediate financial loss and credential compromise. This domain was flagged by PhishDestroy with a 15/95 VirusTotal detection ratio as of the latest scan, indicating it currently evades most antivirus engines. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.45.40, and is currently active. Its configuration suggests an ongoing operation, with no active blocklist entries at the time of analysis. The use of Google Trust Services for the SSL certificate is a tactic to bypass browser-based security warnings, as the domain does not belong to any legitimate Google service. If you have visited start-ledgrer--com.pages.dev, immediately cease all interactions with the site and disconnect any wallets or accounts that may have been exposed. Do not enter any credentials, private keys, or recovery phrases into the site. Clear browser cache and cookies related to crypto services to prevent further exposure. Report the domain to your local cybercrime unit or phishing reporting platforms such as PhishDestroy, Google Safe Browsing, or your country's cybersecurity authority. Monitor your crypto wallets and financial accounts for unauthorized transactions, especially in the next 72 hours, as scammers often initiate rapid theft after credential harvesting.