connect-ledgrdesktop-learn[.]pages[.]dev

PhishDestroy identifies connect-ledgrdesktop-learn.pages.dev as a confirmed phishing site impersonating the official Ledger Desktop application download page. This malicious domain was flagged with zero detections out of 95 VirusTotal scans, indicating it has evaded detection by most security engines despite its active deployment. The site leverages Cloudflare Pages to host a convincing replica of Ledger’s interface, tricking users into entering their recovery phrases or private keys under the guise of updating their wallet software. This domain was registered through Cloudflare, Inc., resolving to IP address 188.114.97.3, and secured with a Google Trust Services SSL certificate—tactics commonly used to appear legitimate. The absence of detections (15/95) suggests this threat is still in its early stages, allowing the attackers to operate undetected. Its Pages.dev subdomain further mimics official Ledger documentation or support portals, a technique frequently exploited in cryptocurrency-targeted phishing campaigns. The registration and hosting infrastructure are designed to bypass traditional security filters, making it a high-risk vector for credential theft and fund misappropriation. If you visited connect-ledgrdesktop-learn.pages.dev or entered any sensitive information—such as recovery phrases, private keys, or login credentials—immediately revoke access to your Ledger wallet or hardware device. Disconnect the device from any computer, reset it to factory settings if possible, and generate a new wallet address. Monitor your transaction history for unauthorized transfers and report any suspicious activity to Ledger Support and your local cybercrime unit. Avoid downloading wallet software from unofficial domains; always verify the URL and use only the official Ledger website (ledger.com) or trusted app stores. Enable multi-factor authentication on all crypto-related accounts and consider using a hardware wallet for enhanced security.