learn-ledgrdesktop[.]pages[.]dev

PhishDestroy identifies learn-ledgrdesktop.pages.dev as an ACTIVE crypto drainer posing as Ledger Live to deceive users into connecting wallets and approving malicious transactions. This domain is currently under investigation due to its high-risk nature and alignment with known crypto-draining infrastructure. The threat is classified as a crypto drainer, not generic phishing, as observed in its domain structure and Cloudflare-hosted landing page mimicking legitimate Ledger services. This domain was flagged through automated pipeline seed 569eed and is currently resolving to IP 172.66.44.54 with a Google Trust Services SSL certificate. It was registered through Cloudflare, Inc., and currently shows 13 out of 95 VirusTotal detections, indicating it has not yet been widely flagged by antivirus engines. The domain uses a Cloudflare Pages.dev subdomain, a common tactic to appear legitimate while bypassing traditional domain reputation checks. It has no current presence on major blocklists such as PhishTank, OpenPhish, or URLVoid, which suggests it is either newly active or deliberately structured to evade early detection. Users should avoid visiting or interacting with learn-ledgrdesktop.pages.dev, especially if prompted to connect a cryptocurrency wallet or enter recovery phrases. The absence of detections (13/95 on VirusTotal) makes this domain particularly dangerous, as it bypasses most real-time browser and endpoint protections. Verify any suspicious Ledger-related domains using PhishDestroy’s real-time scanner before taking action. If already exposed, disconnect your wallet immediately, revoke any unauthorized permissions via blockchain explorers, and transfer remaining funds to a cold wallet if compromised. Always cross-check domain URLs against official Ledger domains (ledger.com) and enable phishing protection in your wallet software.