ledger-live-app-download[.]pages[.]dev

PhishDestroy identifies a live impersonation domain targeting Ledger users with a fake software download portal. The domain ledger-live-app-download.pages.dev is actively serving phishing content that mimics the legitimate Ledger Live application interface, tricking victims into downloading malicious software instead of the authentic app. This attack vector is particularly dangerous because it leverages the trusted brand name during cryptocurrency wallet setup or updates, potentially compromising private keys and digital assets. This domain was flagged by 1 out of 95 VirusTotal security vendors, confirming its malicious nature despite utilizing Google Trust Services SSL certificates. The domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., which is leveraging Pages.dev infrastructure to host the fraudulent content. The active status indicates this is not an abandoned or parked domain, but rather a purpose-built phishing site that requires immediate attention from security teams and cryptocurrency users. Users who have visited ledger-live-app-download.pages.dev should immediately disconnect any affected devices from the internet and run a comprehensive malware scan using up-to-date security software. Never enter seed phrases, private keys, or wallet passwords into websites claiming to be Ledger services. If you downloaded any software from this domain, uninstall it immediately and consider transferring your cryptocurrency assets to a newly created, secure wallet. Report this domain to Ledger's official support channels and consider changing passwords on all accounts that may have been exposed during the visit.