now-ledgr-desktop-live[.]pages[.]dev

PhishDestroy identifies now-ledgr-desktop-live.pages.dev as an active fake Ledger Live desktop portal hosted on Cloudflare Pages and currently undetected by VirusTotal. The domain resolves to 172.66.47.203 and is served over a Google Trust Services SSL certificate, which lures cryptocurrency users into entering their 24-word recovery phrases under the guise of a desktop application update. This is a classic credential-harvesting campaign targeting holders of Ledger hardware wallets.

This domain was flagged with a generic_phishing label on seed fba210 and shows zero detections out of 95 VirusTotal engines as of the latest scan. It is registered through Cloudflare, Inc., and resolves to IP address 172.66.47.203 via Cloudflare Pages infrastructure. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy in this context. Creation date and domain age are not yet available in public records, and it has not been listed on major blocklists such as Google Safe Browsing, PhishTank, OpenPhish, or URLVoid at the time of analysis. Trust scores from WOT, TRUSTe, and other reputation engines remain neutral or absent.

To mitigate exposure, users must avoid interacting with this domain or any links referencing it. If credentials or seed phrases were entered, immediately transfer all assets to a new wallet using only official Ledger Live software downloaded from ledger.com. Enable Ledger’s passphrase feature and verify every transaction on the device screen. Report the domain to Ledger’s abuse team and submit the URL to VirusTotal, Google Safe Browsing, and your local CERT. Use hardware wallet-only signing for all transactions and disable browser-based wallet extensions to reduce attack surface. Monitor blockchain addresses for unauthorized transfers and consider revoking any exposed API keys or browser permissions associated with the affected wallet.