leedger-dsktop[.]pages[.]dev

PhishDestroy identifies leedger-dsktop.pages.dev as an active crypto drainer phishing domain operating at an elevated risk level. This fraudulent site masquerades as a legitimate Ledger wallet interface to trick users into surrendering private keys or seed phrases, enabling cryptocurrency theft. The domain exploits Cloudflare’s Pages.dev platform to host malicious JavaScript payloads that intercept clipboard data or simulate wallet transaction errors to extract sensitive information. This domain was flagged by 3 out of 95 VirusTotal security vendors, indicating limited but concerning detection. It is registered through Cloudflare, Inc., and resolves to IP 172.66.45.26, a known hosting range associated with malicious activity. The use of a Cloudflare Pages.dev subdomain suggests low-cost deployment and evasion of traditional web filtering, while the IP’s reputation remains questionable due to prior associations with phishing and malware distribution. Although no specific creation date is publicly available, the domain’s recent detection and low trust score across multiple engines signal a high-risk, short-lived operation typical of crypto drainer campaigns. Users must immediately avoid interacting with leedger-dsktop.pages.dev and should report the domain to their browser provider or security vendor. Enable hardware wallet verification and never enter seed phrases into web interfaces. Block the IP 172.66.45.26 at the network level and scan devices for clipboard hijackers or keyloggers. Always verify URLs via official channels and use multi-factor authentication on all crypto accounts.