legr-desktop-io[.]pages[.]dev

The domain legr-desktop-io.pages.dev targets users by impersonating Ledger, a well-known cryptocurrency hardware wallet brand. Despite being taken down, it was initially active and not detected by any of the 94 antivirus engines on VirusTotal. This indicates its freshness and the exploitation of the critical 24-72 hour window before antivirus databases are updated. PhishDestroy's early detection highlights the domain's potential threat before it could propagate widely.

Registered with Cloudflare, Inc. and hosted on an IP address located in Canada, the domain used a misleading page title, "Ledger® Live: Desktop® — Getting Started," to lure users into believing it was legitimate. The SSL certificate issued by Google Trust Services further added a veneer of credibility to the scam. The domain's platform risk score was 53 out of 100, suggesting a moderate level of threat based on its characteristics and activity.

The impersonation scam was effectively blocked by PhishDestroy, as it is the only public blocklist to include this domain. This proactive measure underscores the importance of early detection systems in identifying and mitigating phishing threats before they gain traction. By leveraging upstream threat intelligence, PhishDestroy captures such domains in their nascent stages, providing crucial protection against emerging scams.