ledger-livedsktop[.]pages[.]dev

PhishDestroy has flagged ledger-livedsktop.pages.dev as an active brand impersonation scam designed to mimic Ledger, a trusted cryptocurrency hardware wallet provider. The threat actor leverages a deceptive domain structure—specifically the misspelled 'livedsktop' variant—to exploit user trust and harvest sensitive account credentials or seed phrases under the guise of legitimate Ledger support. This impersonation technique is commonly paired with fake software updates or security alerts to trick victims into downloading malicious software or entering login details on fraudulent portals. The site is currently under investigation for distributing a drainer kit targeting cryptocurrency users.

This domain was registered via Cloudflare, Inc., and leverages Google Trust Services for SSL encryption, lending it a veneer of legitimacy. It resolves to IP address 188.114.97.3 and currently shows 0 detections out of 95 scans on VirusTotal, remaining undetected by most security engines. The domain appears to have been created recently (exact date pending WHOIS verification), but despite this, it has already been added to at least one blocklist, indicating early recognition of malicious intent. While the domain is not flagged in Google Safe Browsing (GSB), its use of the Cloudflare Pages.dev subdomain platform may complicate takedown efforts due to Cloudflare’s abuse mitigation response times.

As of this report, the threat status is marked 'active' with risk still under evaluation. PhishDestroy is coordinating with the infrastructure provider and affected brands to initiate takedown procedures. Users are strongly advised to verify download sources directly from the official Ledger website (ledger.com) and avoid clicking links from unsolicited communications. The remaining risk is rated as developing, with potential for increased phishing campaigns targeting crypto users if the domain remains operational. Immediate action is warranted to prevent further victimization.