leedger-llive-desktop[.]pages[.]dev

This domain, leedger-llive-desktop.pages.dev, is flagged as a high-risk brand impersonation phishing site targeting Ledger, a cryptocurrency hardware wallet provider. The page mimics the official Ledger Live application interface, presenting itself as the legitimate "All-in-One Crypto Wallet App" to deceive users into entering sensitive credentials or recovery phrases. Analysis indicates no explicit drainer kit integration at this stage, though the infrastructure supports rapid deployment of malicious scripts if required. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 03, 2026, and resolves to the IP address 172.66.47.42, hosted in a Cloudflare data center in California. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging cloud-based hosting to evade detection. VirusTotal reports 12 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) status remains unconfirmed, though the domain is actively blocked by at least one threat intelligence feed. The domain remains operational as of the latest verification, posing an ongoing risk to users unfamiliar with Ledger’s legitimate domains. Response actions include submission to additional threat intelligence platforms for broader blocking and monitoring for dynamic content changes that may introduce credential-harvesting or cryptocurrency-draining functionality. Users are advised to verify domain authenticity by cross-referencing with official Ledger communication channels and to avoid entering sensitive information on unverified platforms. Organizations should update web filtering rules to block access to this domain and monitor for related infrastructure reuse.