led-ger-des-top[.]pages[.]dev

The domain led-ger-des-top.pages.dev has been identified as a high-risk brand impersonation threat actively targeting users of the Ledger cryptocurrency hardware wallet. Currently classified as active and dangerous, this site mimics the official Ledger platform with a page title of "ledger desktop | Ledger Crypto Wallet - Security for DeFi & Web3" in an attempt to deceive visitors into revealing sensitive information.

Technical analysis reveals that this domain was created on April 24, 2026, and is registered through Cloudflare Pages, a common service used by threat actors for rapid deployment. It resolves to IP address 172.66.44.199 and is secured with an SSL certificate issued by Google Trust Services / WE1, which lends a false sense of legitimacy. According to VirusTotal, 3 out of 95 security vendors flag this domain as malicious, and it appears on at least 1 security blocklist. These indicators confirm that the site is designed to harvest login credentials and seed phrases from unsuspecting Ledger users.

Given its active status and high risk level, users are strongly advised to avoid visiting led-ger-des-top.pages.dev under any circumstances. PhishDestroy recommends that anyone who has interacted with this site immediately change their Ledger account credentials and enable two-factor authentication. Additionally, users should monitor their crypto wallets for unauthorized transactions and report the domain to their email or security provider to prevent further exposure.