ledgerlive-desktop-people[.]pages[.]dev

PhishDestroy identifies a crypto drainer masquerading as the official LedgerLive Desktop application on the domain ledgerlive-desktop-people.pages.dev. This malicious site mimics Ledger’s branding to trick users into downloading a counterfeit installer that drains crypto wallets upon execution. The threat actor leverages a legitimate Cloudflare-hosted page to distribute a malicious payload, bypassing initial detection with a clean 7/95 VirusTotal score at the time of analysis. This domain was flagged by PhishDestroy with the following technical indicators: SSL certificate issued by Google Trust Services, domain registration through Cloudflare, Inc., and resolution to IP address 188.114.97.3. The domain remains unlisted on major blocklists as of the latest check. While the creation date is unverified, the active status indicates ongoing abuse. Users should treat this domain with extreme caution, as it poses a direct risk to cryptocurrency holdings. If you have visited ledgerlive-desktop-people.pages.dev or downloaded any files from the page, immediately disconnect from the internet, scan your device with reputable antivirus software, and review wallet transactions for unauthorized activity. Do not enter any sensitive information or transfer funds from wallets accessed on this domain. Report the incident to PhishDestroy for further analysis and blocklist updates to protect others from this threat.