en-desktop-ledgrer[.]pages[.]dev

PhishDestroy identifies en-desktop-ledgrer.pages.dev as a live crypto drainer site currently impersonating Ledger hardware wallet users. The page uses a Pages.dev subdomain created via Cloudflare Registrar and resolves to IP 188.114.97.3. No known drainer kit signatures have been extracted from the payload yet, but the site is actively serving a fake Ledger firmware update page that requests wallet seed phrases and private keys. Initial lure is spread via fake support emails and fraudulent Ledger-branded ads on social media.

Forensic indicators show zero VirusTotal detections despite active distribution, with SSL issued by Google Trust Services on an undetermined date. The domain is hosted on Cloudflare Pages, leveraging IP 188.114.97.3 within ASN 13335. Google Safe Browsing status remains under_investigation, and no public blocklists have flagged the domain yet. Creation date is unknown due to Cloudflare’s privacy protection masking registration timestamps. Behavioral analysis reveals immediate redirection attempts to external wallet drainer domains after fake “device update” initiation, confirming active exploitation phase.

This domain remains active and unblocked across major browsers and security platforms. Cloudflare has not yet suspended the Pages.dev deployment despite escalation attempts, indicating a persistent hosting vector. Users who visited the link are advised to revoke any exposed wallet approvals, transfer funds to clean wallets, and scan devices for malware. Remaining risk is rated high due to zero detection coverage and ongoing distribution via ad networks and phishing campaigns.