leddger-livedesktop[.]pages[.]dev

PhishDestroy identifies leddger-livedesktop.pages.dev as an active crypto drainer campaign impersonating Ledger Live, a leading hardware wallet provider. This domain leverages Cloudflare Pages and a Google Trust Services SSL certificate to mimic legitimate Ledger infrastructure, tricking users into connecting malicious wallet extensions. The campaign has not yet been flagged by VirusTotal antivirus engines, with 0 detections out of 95 scans, while resolving to IP 188.114.97.3. The domain’s rapid deployment through Cloudflare’s infrastructure suggests an evasion tactic to bypass traditional security controls.

This domain poses a severe risk to cryptocurrency users by hosting a fake Ledger Live interface designed to drain wallet funds. Cloudflare Pages allows threat actors to host phishing pages quickly under legitimate-seeming subdomains, while the Google Trust Services SSL certificate adds false legitimacy to the scam. The absence of VirusTotal detections indicates it is a newly emerged threat, currently exploiting the gap in threat intelligence coverage. Users who interact with this page risk exposing seed phrases, private keys, or connecting malicious browser extensions that could lead to irreversible asset theft.

If you accessed this domain, immediately disconnect any connected wallets and revoke suspicious extension permissions. Do not enter any recovery phrases or private keys. Scan your device using reputable antivirus software, such as Malwarebytes or Windows Defender. Report the domain to Google Safe Browsing and your antivirus provider. Monitor your wallet transactions for unauthorized movements. For Ledger users, verify the official site at ledger.com and never download software from third-party links.