ledger-desktp-en[.]pages[.]dev

PhishDestroy identifies ledger-desktp-en.pages.dev as a live crypto drainer phishing page that masquerades as the official Ledger Live Desktop installer. The site lures victims into downloading a malicious payload that drains cryptocurrency wallets under the guise of a legitimate update. SSL certificate issued by Google Trust Services is used to mimic trust, while Cloudflare obscures the true hosting origin at IP 188.114.97.3. This domain is actively serving a tailored crypto-draining script targeting Ledger users, indicating a focused, high-risk campaign rather than generic phishing. This domain was flagged under seed c811da with a VirusTotal detection score of 7 out of 95 scanners at the time of analysis. The site is registered through Cloudflare, Inc. and resolves to IP 188.114.97.3, showing no current listing on major threat blocklists. Despite its low detection rate, behavioral and content analysis confirms it is a crypto drainer designed to steal private keys and seed phrases from unsuspecting users who believe they are installing official Ledger software. If you have visited ledger-desktp-en.pages.dev, immediately stop interacting with the page and do not enter any wallet credentials, seed phrases, or private keys. Disconnect any affected device from the internet, and scan it with updated antivirus and anti-malware tools. Consider revoking wallet access from any device that may have been exposed and transferring remaining assets to a newly generated wallet on a clean device. Monitor your wallet transactions closely for unauthorized transfers. Report the domain to your antivirus provider and consider blocking it via your hosts file or firewall to prevent future exposure.