desktop-ledger-help[.]pages[.]dev

PhishDestroy identifies desktop-ledger-help.pages.dev as an active crypto drainer posing as Ledger support to steal cryptocurrency. This malicious domain leverages a spoofed “help” subdomain to deceive users into connecting wallets or entering seed phrases, enabling direct asset theft via a drainer kit detected in the wild. The campaign specifically targets users seeking technical assistance, capitalizing on the trust associated with Ledger’s brand reputation to maximize victim engagement.

Technical indicators confirm elevated risk: the domain carries a VirusTotal detection score of 2/95 security vendors, is registered through Cloudflare, Inc., and resolves to IP 172.66.47.97. The SSL certificate is issued by Google Trust Services, adding superficial legitimacy. While Google Safe Browsing (GSB) status remains unconfirmed in this dataset, the low detection rate suggests it has evaded broad blacklisting, increasing exposure for potential victims. Creation date and additional blocklist participation cannot be verified from available intelligence, indicating a relatively recent or stealthily operated campaign.

As of current analysis, desktop-ledger-help.pages.dev remains active and unblocked by major browsers or security platforms. PhishDestroy assesses the risk level as elevated due to the drainer’s operational status and deceptive branding. Users are strongly advised to avoid interacting with this domain, verify support channels directly via Ledger’s official website, and never enter wallet credentials or seed phrases on third-party sites. Blocking 172.66.47.97 at the network level is recommended for organizations. Remaining risk persists due to ongoing domain agility and low vendor detection, necessitating continuous monitoring and proactive user education.