leedger-live-desk-top[.]pages[.]dev

PhishDestroy identifies leedger-live-desk-top.pages.dev as a live crypto drainer posing as an official Ledger desktop application installer. The domain leverages Cloudflare Pages to host a lookalike interface that prompts users to connect wallets under the guise of updating or initializing their Ledger device. Unsuspecting victims may download a malicious payload that exfiltrates private keys or signs unauthorized transactions, leading to irreversible asset loss. SSL encryption via Google Trust Services adds a false sense of legitimacy, while the current lack of detection on VirusTotal (3/95) highlights the rapidly evolving nature of this threat. This domain was registered through Cloudflare, Inc. and resolves to IP 172.66.46.249. VirusTotal currently shows zero detections despite active abuse, and Cloudflare's infrastructure complicates takedown efforts. The Pages.dev subdomain indicates a quick deployment method favored by threat actors to bypass traditional domain-based blacklists. Security researchers should monitor for additional samples leveraging Ledger branding across similar services as this campaign expands. If you visited this domain or downloaded any files, immediately disconnect from the internet, revoke any wallet connections made through the fake interface, and run a full system scan using reputable antivirus software. Users are strongly advised to verify the legitimacy of Ledger downloads by cross-checking against official sources at ledger.com and using hardware device verification. PhishDestroy recommends reporting the domain and any associated wallet addresses to relevant blockchain monitoring platforms to prevent further fund loss.