ledger-live-desktop[.]pages[.]dev

PhishDestroy identifies ledger-live-desktop.pages.dev as a brand impersonation scam currently impersonating Ledger’s Live Desktop application, a widely used cryptocurrency wallet management tool. The domain leverages a deceptive naming convention by incorporating ‘ledger-live-desktop’ in its subdomain to closely mirror the legitimate service, likely targeting users seeking safe desktop wallet software. While no advanced drainer kit has been confirmed, this site may ultimately lead to wallet credential theft or cryptocurrency theft once the fake installer is executed. Cloudflare Workers is being exploited to host this fraudulent service, demonstrating the increasing use of legitimate cloud platforms by threat actors to bypass traditional network defenses. The campaign is believed to be in active distribution, with redirection chains likely leading victims from phishing emails or malicious advertisements to this fraudulent portal. At this time, the full scope of the operation—including C2 infrastructure and mule networks—remains under investigation as analysts continue to trace the operational footprint.

Ledger-live-desktop.pages.dev exhibits several technical indicators that define its malicious nature. According to VirusTotal data, the domain remains undetected by 6 out of 95 security vendors as of the latest scan, highlighting a critical evasion window before broader detection coverage is achieved. The domain resolves to the IP address 188.114.96.3, an address associated with Cloudflare’s hosting infrastructure, which is commonly leveraged to obscure the true origin and location of malicious services. This domain was registered through Cloudflare, Inc., utilizing their Pages platform—an unusual but growing vector for fraudulent deployment. The SSL certificate is issued by Google Trust Services, further enhancing the appearance of legitimacy by mimicking trusted certificate authorities. Notably, this domain has not been identified on Google Safe Browsing (GSB) blocklists, reinforcing the need for proactive user vigilance and enterprise monitoring. Although exact creation dates are not provided, the combination of unresolved detection status and active hosting suggests recent deployment aimed at capitalizing on user trust in legitimate Ledger services.

This domain is currently listed as ACTIVE with a risk level classified as UNDER_INVESTIGATION, indicating that while immediate threats are plausible, the full threat profile is still being analyzed by cybersecurity teams. No formal takedown or mitigation has been publicly reported at this time, leaving the site operational and accessible. Organizations and individuals are advised to block access to ledger-live-desktop.pages.dev at the network level and refrain from downloading any software from this domain. Users should only download the official Ledger Live Desktop application from ledger.com or verified app stores. Remaining risk includes potential wallet compromise, credential theft, and financial loss due to the impersonation of a trusted crypto wallet provider. Continued monitoring and collaborative threat intelligence sharing are essential to track ongoing activity and prevent further victimization. PhishDestroy will update this report as new evidence emerges regarding the campaign’s infrastructure or additional malicious artifacts.