live-ladger-desktopes[.]pages[.]dev

PhishDestroy identifies live-ladder-desktopes.pages.dev as an active Ledger Live wallet phishing domain distributing a browser-based cryptocurrency drainer kit designed to harvest seed phrases and private keys. The domain mimics the official Ledger Live desktop application interface, tricking users into entering wallet credentials under the guise of a software update or security patch. Security scanners have not yet flagged this campaign, suggesting rapid deployment and low detection latency.

Exact technical indicators include a VirusTotal detection score of 2 out of 95 antivirus engines as of the latest scan, registered through Cloudflare, Inc., resolving to IP address 188.114.97.3, secured with a Google Trust Services SSL certificate, and currently carrying a Google Safe Browsing (GSB) status of under investigation. The domain is part of a known seed family c51ff9, which has been linked to recent cryptocurrency wallet drainer campaigns targeting Ledger and Trezor users. The site appears to have been created recently and remains active, with no confirmed blocklist entries at this time.

This domain is currently active and classified as under investigation by threat intelligence platforms. PhishDestroy recommends immediate blocking of the IP address 188.114.97.3 at the network perimeter and updating endpoint detection rules to flag any connection attempts to live-ladger-desktopes.pages.dev. Users are advised to verify download sources through official Ledger channels only and enable hardware wallet verification for all transactions. The remaining risk is evaluated as high due to active distribution, lack of antivirus detection, and potential compromise of wallet credentials if accessed.