ledjer-live-desktop[.]pages[.]dev

PhishDestroy identifies ledjer-live-desktop.pages.dev as an active crypto drainer domain currently under investigation. This site mimics legitimate desktop applications to deceive users into connecting cryptocurrency wallets or entering recovery phrases, resulting in fund theft. The threat type is classified as a crypto drainer, a high-risk phishing variant designed to exploit blockchain users.

This domain was flagged by PhishDestroy with the following technical indicators: SSL certificate issued by Google Trust Services, registered through Cloudflare, Inc., resolving to IP address 188.114.96.3. As of the latest scan, VirusTotal reports 8/95 security vendors flagging this domain, indicating no proactive detection despite its suspicious nature. The domain is hosted on Cloudflare Pages, a service often abused by threat actors for its anonymity and rapid deployment capabilities. While the infrastructure itself is legitimate, the misuse for crypto drainer campaigns poses significant risks to users.

To mitigate exposure to this crypto drainer, users should avoid accessing ledjer-live-desktop.pages.dev entirely. If you have already interacted with this domain, disconnect your cryptocurrency wallet immediately and revoke any unauthorized permissions through your wallet’s connected app settings. Use a dedicated browser profile or virtual machine for crypto-related activities to isolate potential threats. Report the domain to your antivirus provider, browser security extensions, and platforms like VirusTotal to aid collective defense. Enable hardware wallet authentication where possible and verify all desktop application downloads from official sources only.