live-desktop-eng[.]pages[.]dev

This domain is flagged as a high-risk crypto wallet drainer infrastructure impersonating Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site distributes malicious software designed to exfiltrate private keys and drain connected wallets, rather than merely harvesting credentials. The threat actor has constructed a convincing replica of the legitimate Ledger Live desktop application download page, complete with official branding and product imagery. Infrastructure analysis reveals the following technical indicators: the domain live-desktop-eng.pages.dev resolves to IP 188.114.97.3 (CloudFlare, Inc., Canada) and was registered through Cloudflare Pages on March 28, 2026. The SSL certificate is issued by Google Trust Services (WE1). Detection metrics show 12 of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Despite these detections, the site remains operational at the time of analysis. Mitigation requires immediate action from both users and security teams. Users who may have interacted with this domain should disconnect affected devices from networks, revoke all wallet authorizations, and transfer remaining assets to new wallets using clean hardware. Security teams should implement DNS-based blocking for the domain and IP, deploy endpoint detection rules for the observed malicious payloads, and monitor for connections to 188.114.97.3. Given the high-risk nature of crypto wallet drainers, organizations handling cryptocurrency should implement additional verification steps for all software downloads, including cryptographic signature verification and domain reputation checks before execution.