dsktop-ledgrr[.]pages[.]dev

PhishDestroy identifies dsktop-ledgrr.pages.dev as an active credential theft scam posing as Ledger’s official login portal. This domain is engineered to deceive users into surrendering sensitive wallet recovery phrases, mnemonic seeds, or API keys under the false pretense of a legitimate authentication interface.

This domain was flagged by PhishDestroy with a risk level under investigation but is currently active. Technical indicators include an SSL certificate issued by Google Trust Services, cloud hosting via Cloudflare, Inc., and resolution to the IP address 188.114.96.3. VirusTotal scans show 6 out of 95 detection engines flagged at time of analysis. The domain is registered through Cloudflare Pages, leveraging Pages.dev for rapid deployment and evasion of traditional takedown channels. Although not presently listed on major blocklists such as Google Safe Browsing or PhishTank, the absence of detections does not equate to safety, particularly given the domain’s purpose-built deception tactics.

To mitigate exposure, users should immediately avoid accessing dsktop-ledgrr.pages.dev and verify all Ledger login URLs via the official ledger.com domain. Enable hardware wallet security features such as passphrase protection and Ledger Live’s built-in phishing warnings. Report the domain to Ledger’s abuse team and your local cybercrime unit. If credentials were entered, revoke API keys, rotate recovery phrases, and transfer funds to a newly initialized wallet. Monitor transaction activity closely for unauthorized transfers. Cloudflare should be notified to expedite takedown using the abuse contact at abuse.cloudflare.com.