download--ledgrrcom[.]pages[.]dev

PhishDestroy identifies download--ledgrrcom.pages.dev as an active crypto drainer impersonating the official Ledger wallet platform.

This domain exhibits high-risk behavior as a generic phishing threat targeting cryptocurrency users. VirusTotal analysis confirms 11/95 detections despite active malicious hosting, while infrastructure traces reveal Cloudflare Inc. registration with a Google Trust Services SSL certificate resolving to IP 172.66.45.29. The Cloudflare Pages deployment platform further obfuscates malicious intent while providing threat actors with legitimate infrastructure.

The combination of zero antivirus detection, trusted certificate issuance, and Cloudflare's reputable services creates an elevated threat surface. While the specific creation date remains unverified, the active status combined with zero detection metrics suggests recent deployment designed to evade traditional security measures. Users should immediately avoid this domain and verify all Ledger-related links through PhishDestroy's independent verification system before entering wallet credentials or downloading software. For crypto protection, always cross-reference domains against official Ledger channels and enable hardware wallet verification for transaction signing.