ledger-live-en-desktop-ledgeir[.]pages[.]dev

PhishDestroy identifies ledger-live-en-desktop-ledgeir.pages.dev as an active brand impersonation domain targeting Ledger users. This fraudulent site mimics the official Ledger Live desktop application name to deceive cryptocurrency holders into downloading malicious software or revealing wallet credentials. While no crypto drainer kit has been confirmed in this instance, the domain's structure suggests a high likelihood of credential theft or malware delivery aimed at Ledger’s user base. This domain resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. VirusTotal currently shows 0 detections out of 95 scans, indicating that mainstream security tools have not yet flagged it. The domain’s creation via Google’s Pages.dev platform further highlights its use of legitimate cloud infrastructure to evade detection. As of now, it remains unlisted on Google Safe Browsing (GSB) and has not been widely blocked by threat intelligence platforms. The domain is currently active and under investigation, with no confirmed remediation by hosting providers. Users are advised to avoid interacting with this URL and report it to security teams. The remaining risk is classified as active impersonation, with potential for credential theft or malware delivery. Immediate blocking and continued monitoring are recommended until the threat is neutralized.