begin-ldger-downloaded[.]pages[.]dev

PhishDestroy identifies active phishing infrastructure targeting Ledger wallet users via begin-ldger-downloaded.pages.dev. The campaign is currently live and distributing fraudulent download pages masquerading as the official Ledger Ledger Live software. Users are redirected to this domain under the guise of a critical wallet update, with threat actors harvesting private keys and seed phrases.

This domain was flagged by 5 of 95 VirusTotal vendors at time of analysis, operates behind Cloudflare’s proxy network via IP 172.66.44.179, and leverages a Google Trust Services SSL certificate for authenticity. Registered through Cloudflare, Inc., the domain has not yet been listed on major blocklists. Trust scores remain neutral due to low detection rates and active cloaking behavior. The domain resolves to a Pages.dev subdomain, commonly abused for short-lived phishing lures.

The campaign remains active and evolving. Security teams are advised to block begin-ldger-downloaded.pages.dev at the DNS and firewall levels. Users should verify all Ledger Live downloads directly from ledger.com and enable hardware wallet verification before inputting any recovery phrases. Monitor for unusual outbound connections or unauthorized wallet access. This threat is under active investigation; IOCs may expand as additional infrastructure is uncovered.