# PhishDestroy threat dossier — desktop--learn-ledgrr.pages.dev ================================================================ Fetched: 2026-04-25 06:33:08 UTC Canonical: https://phishdestroy.io/domain/desktop--learn-ledgrr.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, CyRadar, G-Data, Kaspersky, LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.47.117 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: maleah.ns.cloudflare.com, trace.ns.cloudflare.com Registered: 2026-04-02 Page title: Ledger Live Desktop® – Secure Access to Your Hardware Crypto Wallet HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-01 Status: INVALID chain Fingerprint: ad589ff4526294f796c59a05e7d0967df443df0129c0fca159725ca3f58495e4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-02 17:55:22 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:11:38 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d4eaf-bf3f-7366-9d69-57b9b9ec66b7/ Wayback Machine: https://web.archive.org/web/*/desktop--learn-ledgrr.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.desktop--learn-ledgrr.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=desktop--learn-ledgrr.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/desktop--learn-ledgrr.pages.dev URLhaus: https://urlhaus.abuse.ch/host/desktop--learn-ledgrr.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-02 17:55:47 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies desktop--learn-ledgrr.pages.dev as a potential crypto drainer site under active investigation for generic phishing activities. The domain employs a deceptive naming convention, mimicking a legitimate learning or ledger platform to lure unsuspecting users into providing sensitive credentials or cryptocurrency wallet access. While the exact drainer kit remains unverified due to limited detections, the observed infrastructure aligns with common tactics used by threat actors to harvest credentials or initiate unauthorized crypto transfers. The page structure suggests a fake login portal, likely designed to capture user input and exfiltrate data to a remote command-and-control server. Technical analysis of desktop--learn-ledgrr.pages.dev reveals concerning indicators. The domain resolves to IP address 172.66.47.117 and is hosted by Cloudflare, Inc., a common choice for threat actors seeking anonymity and rapid deployment. VirusTotal currently scores the domain at 0/95 detections, indicating no proactive blocking by security vendors at this stage. The SSL certificate, issued by Google Trust Services, further lends an air of legitimacy, though it does little to mask the malicious intent. Registration details remain obscured, but the domain is hosted on Cloudflare's Pages service, which has been increasingly abused for phishing campaigns. As of the latest assessment, this domain has not been flagged by major blocklists, leaving it in a precarious state where users may encounter it without prior warning. PhishDestroy has flagged this domain with an 'active' status due to the combination of high-risk indicators and the lack of detection coverage. Immediate actions include blocking the domain at the network perimeter and advising users to avoid interaction. The current risk level is classified as 'under_investigation,' meaning further analysis is required to confirm the full scope of the campaign, including associated wallets or exfiltration endpoints. Users who suspect exposure to this domain should audit their credentials, revoke any unauthorized sessions, and monitor financial accounts for irregular activity. Remaining risk is considered elevated due to the domain's undetected status and the potential for rapid propagation through phishing emails or social engineering tactics. Organizations are urged to integrate this domain into their threat intelligence feeds without delay. [Updates since narrative was generated:] - VirusTotal detections: now 6/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ad589ff4526294f796c59a05e7d0967df443df0129c0fca159725ca3f58495e4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/desktop--learn-ledgrr.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=desktop--learn-ledgrr.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io