help-desktop-live-ledgr[.]pages[.]dev

PhishDestroy identifies help-desktop-live-ledgr.pages.dev as a live crypto-draining phishing site masquerading as the official Ledger Live desktop login page. If visited, the domain attempts to trick users into connecting a wallet so a hidden script can silently drain tokens directly from connected accounts. Security analysts note the page uses Cloudflare’s pages.dev subdomain routing to 172.66.47.63 and is served over an SSL certificate issued by Google Trust Services, giving it an air of legitimacy even though it is not affiliated with Ledger. This domain was flagged in PhishDestroy’s seed-based pipeline (seed 2f5704) and currently shows zero detections out of 95 engines on VirusTotal, indicating it remains under the radar of many scanners. The site is hosted on Cloudflare Pages and registered through Cloudflare, Inc., which allows rapid spin-up and takedown cycles typical of these fraudulent services. Despite the lack of immediate detection, the infrastructure and naming pattern align with recent crypto-drainer campaigns targeting users of major hardware wallet brands. If you visited help-desktop-live-ledgr.pages.dev, disconnect your wallet immediately, revoke any connected permissions via your wallet’s “connected apps” or “authorized sites” list, and run a malware scan on your device. Do not enter any seed phrases, private keys, or passwords—close the tab and clear browsing data. Use PhishDestroy to check any suspicious links before interacting. Report the domain to PhishDestroy’s database to help protect others from similar crypto-draining attacks.