ledgcom-download[.]pages[.]dev

PhishDestroy identifies ledgcom-download.pages.dev as an active phishing domain masquerading as a Ledger wallet download page. The site employs a cryptocurrency drainer kit designed to trick users into connecting their wallets and transferring funds to attacker-controlled addresses. No specific brand impersonation beyond Ledger’s wallet ecosystem has been detected, suggesting a targeted campaign against cryptocurrency users familiar with hardware wallet solutions.

Technical indicators confirm this domain as a high-risk threat vector. VirusTotal currently shows 13/95 detections, indicating evasion against most antivirus engines. Registered via Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and operates under a Google Trust Services SSL certificate. While the exact creation date remains unverified, the domain’s recent emergence aligns with active phishing campaigns exploiting Ledger’s reputation. Google Safe Browsing (GSB) has not yet flagged this domain, and public blocklists show no prior detections. The absence of these safeguards highlights the domain’s stealthy deployment.

Current status remains active, with no takedown actions observed. Users should avoid interacting with this domain and report it to their security teams or browser vendors. Remaining risk is high due to the drainer kit’s sophistication and low detection rates. Immediate mitigation includes DNS blocking of 188.114.96.3 and Cloudflare’s infrastructure, alongside user education on verifying wallet download sources. The threat’s evolving nature, combined with zero detections, underscores the need for proactive monitoring and rapid response to prevent financial losses.