com-ldger-x-dekstop[.]pages[.]dev

This domain is actively impersonating Ledger, a hardware cryptocurrency wallet provider, to distribute crypto drainer malware or harvest wallet credentials. The site presents itself as the official Ledger Live Desktop application, using identical branding, page layout, and terminology to deceive users into entering sensitive recovery phrases or private keys. Analysis of the domain reveals it hosts a near-identical replica of the legitimate Ledger Live interface, specifically targeting users attempting to manage or secure their crypto assets. The threat extends beyond credential theft, as interacting with the site may trigger automated scripts designed to drain connected wallets upon input of sensitive information. Infrastructure analysis reveals the domain com-ldger-x-dekstop.pages.dev was registered on April 09, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.101. Security vendors on VirusTotal flag this domain at a rate of 8 out of 95, indicating moderate but growing detection. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to malicious sites. The IP address geolocates to Cloudflare infrastructure in Canada, a frequent hosting choice for threat actors due to the provider's privacy and proxy services. Users who have visited com-ldger-x-dekstop.pages.dev or entered any credentials should immediately revoke access to connected wallets and transfer remaining assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and consider a full system scan for malware, particularly browser-based crypto drainers. Report the domain to relevant security teams and avoid interacting with any communications or prompts originating from the site. If recovery phrases or private keys were exposed, treat the compromised wallet as permanently at risk and cease all further use.