ledgerlive-deskttp[.]pages[.]dev

PhishDestroy’s automated crawlers flagged ledgerlive-deskttp.pages.dev as an active brand-impersonation domain targeting Ledger cryptocurrency users. The page masquerades as the official Ledger Live desktop application, attempting to trick visitors into downloading a malicious wallet drainer kit designed to empty crypto wallets. No evidence of a custom drainer family was observed in the payload path, suggesting the threat actor is reusing publicly available drainer scripts to maximize reach while minimizing development overhead.

Technical indicators confirm the domain’s malicious infrastructure. WHOIS data shows Cloudflare, Inc. as the registrar, with resolution to IP address 188.114.96.3. The domain acquired an SSL certificate issued by Google Trust Services, enabling HTTPS encryption to evade network-level detection. At the time of analysis, VirusTotal scored the site 2/95 detections, indicating it remains undetected by most antivirus engines. Historical records indicate the domain was created within the last 30 days, and it has not yet been listed on Google Safe Browsing (GSB) or major threat intelligence blocklists.

PhishDestroy has marked the domain status as active and under investigation. The site is currently resolving and serving the impersonation page, but no drainer payload has been confirmed at the time of writing. Users should block 188.114.96.3 at the firewall and refrain from visiting ledgerlive-deskttp.pages.dev. The remaining risk is assessed as high due to the combination of fresh registration, low detection coverage, and active impersonation tactics targeting Ledger customers.