know-ldgrrlive-desk[.]pages[.]dev

PhishDestroy identifies active crypto drainer abuse via know-ldgrrlive-desk.pages.dev, which masquerades as the legitimate Ledger Live desktop application to trick users into connecting wallets and approving malicious transactions.

This domain exhibits a high-risk profile: it registered 0 detections out of 95 engines on VirusTotal, operates under Cloudflare’s pages.dev platform, resolves to IP 172.66.44.108, and holds a Google Trust Services SSL certificate—none of which are indicative of trustworthiness. The domain’s positioning on a free Cloudflare Pages subdomain (pages.dev) deliberately obscures its origin while providing infrastructure that often hosts malicious content. Without a known creation date or inclusion on major blocklists, this asset remains in early-stage abuse, presenting an elevated threat to cryptocurrency users seeking legitimate software downloads.

Users should treat any download link from know-ldgrrlive-desk.pages.dev or similar subdomains as a high-confidence risk. Only obtain Ledger Live directly from ledger.com or official app stores. If already exposed, revoke wallet connections via Ledger Live, transfer assets to a cold wallet, and scan systems with updated antivirus. Report the domain to Ledger’s abuse team and your local CERT. Monitor wallet approvals closely—unexpected transaction requests may signal compromise.