ledger-liv-dsktop[.]pages[.]dev

This domain is an active brand impersonation threat targeting cryptocurrency users by replicating the Ledger Live wallet interface. The site presents itself as a legitimate platform for sending, receiving, and tracking digital assets, but analysis confirms it is designed to harvest credentials, private keys, or seed phrases from unsuspecting victims. The fraudulent nature is evident in its attempt to deceive users into believing they are interacting with official Ledger software, which could lead to unauthorized access to crypto holdings and financial loss. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on September 27, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.172, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal have flagged this domain, with 7 out of 95 engines detecting it as malicious. Additionally, the SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging free certificates to appear legitimate. The domain also appears on at least one security blocklist, further confirming its high-risk status. Users who have visited ledger-liv-dsktop.pages.dev should take immediate action to mitigate potential risks. If any credentials, private keys, or seed phrases were entered on the site, assume they are compromised and revoke access to associated crypto wallets immediately. Rotate all passwords and enable multi-factor authentication on legitimate accounts. Monitor connected wallets for unauthorized transactions and consider transferring assets to a new wallet if suspicious activity is detected. Report the domain to relevant security teams and avoid interacting with it further to prevent additional exposure.