ledgr-usa-desktop[.]pages[.]dev

PhishDestroy identifies ledgr-usa-desktop.pages.dev as a generic phishing domain impersonating the official Ledger desktop application. The site leverages Cloudflare Pages and a deceptive .pages.dev subdomain to mimic a legitimate software update, targeting cryptocurrency users with a malicious drainer kit designed to siphon funds from victim wallets. No specific brand or drainer kit has been confirmed in this early-stage investigation, but the modus operandi aligns with crypto phishing campaigns observed targeting Ledger hardware wallet users. Given the absence of detections on VirusTotal and the use of legitimate infrastructure (Cloudflare, Google Trust Services SSL), this threat exemplifies the increasing sophistication of cryptocurrency-focused phishing operations.

This domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc. According to VirusTotal data accessed with seed d659d1, it has achieved 8/95 detections across leading antivirus engines as of the latest scan, indicating it is not yet widely flagged. The SSL certificate is issued by Google Trust Services, which adds to its appearance of legitimacy. While the exact creation date of the domain is not specified in the referenced data, the low detection rate combined with its Cloudflare Pages hosting suggests a relatively new deployment aimed at evading early detection mechanisms. Blocklist status remains unconfirmed in publicly available sources, but the lack of AV detections highlights the urgency for proactive monitoring and user awareness.

As of the latest assessment, ledgr-usa-desktop.pages.dev is classified as an active phishing threat under investigation, with a risk level categorized as under_investigation. The domain has not yet been formally added to major threat intelligence feeds or blocklists, leaving users vulnerable to exposure. Immediate actions include: blocking all traffic to and from IP 188.114.96.3 and the domain itself at the network and endpoint levels; alerting cryptocurrency wallet users—particularly those using Ledger devices—to verify software sources via official channels only; and updating browser security tools to detect similar impersonation patterns. The residual risk remains elevated due to the domain’s use of trusted infrastructure and delayed antivirus detection, emphasizing the need for ongoing monitoring and rapid response coordination across security teams.