install-ledgdesk[.]pages[.]dev

PhishDestroy identifies install-ledgdesk.pages.dev as a crypto drainer domain actively distributing malicious payloads to unsuspecting users. This Pages.dev subdomain masquerades as a legitimate software installer, exploiting trust in Google’s hosting infrastructure to deceive visitors into connecting cryptocurrency wallets or downloading disguised malware. Once accessed, the page likely triggers wallet-draining scripts or credential theft mechanisms, silently transferring funds or harvesting sensitive data without user consent. This domain was flagged with 0 detections out of 95 engines on VirusTotal as of seed 81b7db, indicating it remains under the radar of most antivirus tools. It is registered through Cloudflare, Inc., resolving to IP 188.114.96.3 via Google Trust Services SSL certificates. While creation and blocklist details are still under investigation, the absence of detections suggests a recently deployed or highly targeted campaign. Users who visited install-ledgdesk.pages.dev should immediately disconnect any connected wallets, revoke any unauthorized transactions, and scan their devices with updated antivirus software. Avoid re-entering sensitive credentials or connecting wallets to unknown domains. Report the domain to your wallet provider and relevant cybersecurity platforms to help block further abuse.