learn-ledgerdesktop--en[.]pages[.]dev

PhishDestroy identifies learn-ledgerdesktop--en.pages.dev as an active cryptocurrency drainer domain impersonating Ledger, a well-known hardware wallet brand. As of the current analysis, this domain remains under investigation but continues to operate with an active status, posing an ongoing risk to unsuspecting users seeking legitimate Ledger-related services.

This domain was flagged by 6 of 95 VirusTotal vendors and is registered via Cloudflare, Inc., resolving to IP address 172.66.47.94. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to the malicious infrastructure. The domain operates behind Cloudflare’s proxy, obscuring underlying hosting details and complicating direct takedown efforts. While detection rates remain low at present, the absence of vendor alerts does not equate to safety; this domain is engineered to deceive users through brand imitation and malicious JavaScript execution designed to siphon cryptocurrency from victims’ wallets during transaction signing.

PhishDestroy recommends immediate network and endpoint blocking of learn-ledgerdesktop--en.pages.dev and the associated IP 172.66.47.94. Users are strongly advised to verify any Ledger-related domains via the official Ledger website (ledger.com) and only download software or firmware from verified sources. All wallet transaction approvals should be manually inspected, especially when prompted by unexpected browser extensions or modified desktop applications. Enterprise and MSSP SOC teams should add this domain to threat intelligence feeds and firewall rules, and investigate potential exposure in environments where users may interact with cryptocurrency services. Monitor for similar domains leveraging Ledger branding with double hyphens or similar obfuscation patterns to prevent further campaigns.