home-ledgrdesktop[.]pages[.]dev

PhishDestroy identifies home-ledgrdesktop.pages.dev as an active crypto-draining scam leveraging a spoofed Ledger Live interface to siphon cryptocurrency from victims. The domain resolves to a Cloudflare Pages deployment hosted on 188.114.97.3, using a Google Trust Services SSL certificate to mimic legitimate Ledger infrastructure. Threat analysis reveals a drainer kit designed to intercept wallet connections and prompt users for seed-phrase or private-key input, with no legitimate branding or functional integration beyond credential harvesting. This domain was flagged by PhishDestroy with a VirusTotal detection ratio of 1/95 security vendors as of seed dd59f6. It is registered through Cloudflare, Inc., resolving to IP 188.114.97.3 via Cloudflare Pages infrastructure. The domain carries a Google Trust Services SSL certificate and is currently unlisted on Google Safe Browsing (GSB) with no confirmed blocklist presence. Technical telemetry suggests recent creation but sustained operational persistence, indicating ongoing campaign refinement. Current status remains active with elevated risk due to low vendor detection and impersonation of a high-value brand. Response actions include domain takedown outreach to Cloudflare Trust & Safety and escalation to Google Safe Browsing. Despite these efforts, residual risk persists due to the transient nature of Cloudflare Pages deployments and the lack of proactive blocking by major security vendors. Users are strongly advised to verify any Ledger-related links using PhishDestroy prior to interaction.