ledjer-desktop[.]pages[.]dev

PhishDestroy identifies ledjer-desktop.pages.dev as an active crypto drainer phishing domain currently under investigation. This domain, hosted via Cloudflare Pages, is distributing fraudulent content designed to siphon cryptocurrency from unsuspecting victims. The threat is classified as a crypto drainer due to its targeting of digital asset wallets and transaction interception tactics.

This domain was flagged by zero of 95 VirusTotal vendors, indicating it remains undetected by most scanning engines as of the latest sweep. It resolves to IP address 188.114.96.3 and utilizes a Google Trust Services SSL certificate, a tactic commonly employed to enhance phishing credibility. Registered through Cloudflare, Inc., the domain’s infrastructure suggests an attempt to leverage reputable service providers to evade scrutiny. No additional blocklist entries or trust score metrics were available at the time of analysis.

Current intelligence indicates the domain is active and poses an ongoing risk to users interacting with cryptocurrency platforms or wallets. Given the absence of detections and the use of trusted infrastructure, immediate defensive action is required. Organizations and individuals are advised to block all communications with ledjer-desktop.pages.dev at the network perimeter. Additionally, users should verify cryptocurrency transaction URLs via official sources and enable multi-factor authentication on all wallet interfaces. Continuous monitoring for related infrastructure is strongly recommended due to the adaptive nature of crypto drainer campaigns.