walet-ledger[.]pages[.]dev

PhishDestroy identifies walet-ledger.pages.dev as an active crypto drainer domain posing as a Ledger wallet interface. This malicious site specifically targets cryptocurrency holders by tricking visitors into connecting their wallets and approving fraudulent transactions that drain digital assets. The domain resolves to IP 188.114.97.3 through Cloudflare’s infrastructure, using a Google Trust Services SSL certificate to appear legitimate. Initial analysis shows this domain currently evades detection with 13/95 VirusTotal detections, though it represents a clear financial threat to unsuspecting users.

Technical indicators reveal this crypto drainer operates under Cloudflare’s Pages.dev platform, which has become a common hosting vector for fraudulent cryptocurrency services. The domain’s SSL certificate issued by Google Trust Services adds a veneer of legitimacy, potentially tricking users into believing the site is secure. While no blocklist detections are currently recorded, the domain’s active status combined with its specific targeting of cryptocurrency users warrants immediate caution. The IP address location (188.114.97.3) sits within Cloudflare’s infrastructure, making traditional IP-based blocking less effective against this particular threat.

Users who visited walet-ledger.pages.dev should immediately disconnect any connected cryptocurrency wallets and revoke any permissions granted to this domain. Check wallet transaction history for unauthorized transfers and consider transferring remaining assets to a secure, offline wallet. Report this domain to your wallet provider and relevant cryptocurrency security platforms. Enable multi-factor authentication on all crypto accounts and avoid clicking links in unsolicited messages or advertisements. Always verify website domains match official provider domains before entering wallet credentials or making transactions.