ledeger-liv-desktop[.]pages[.]dev

This domain, ledeger-liv-desktop.pages.dev, is identified as a fraudulent crypto wallet drainer designed to steal cryptocurrency from unsuspecting users. The site impersonates legitimate wallet interfaces, tricking visitors into entering recovery phrases or private keys, which are then transmitted to attackers. Such schemes typically target users of popular hardware and software wallets, exploiting trust in well-known brands to facilitate unauthorized transactions and asset theft. Analysis indicates the domain was registered through Cloudflare Pages and created on March 27, 2026, though this date may reflect automated or falsified registration data. The domain resolved to the IP address 172.66.44.241 and was flagged by 8 out of 95 security vendors on VirusTotal, including detection by PhishDestroy. Additionally, the domain appeared on one security blocklist, and its Gridinsoft trust score was 0 out of 100, further confirming its malicious nature. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing infrastructure. Users who visited ledeger-liv-desktop.pages.dev or entered sensitive information should take immediate action. Disconnect any devices used to access the site from the internet to prevent further data exfiltration. Revoke any active wallet sessions and transfer assets to a new, secure wallet using a fresh recovery phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If private keys or recovery phrases were exposed, assume all associated wallets are compromised. Report the incident to relevant wallet providers and consider filing a report with local cybercrime authorities.