ledger-live-destop-welcome[.]pages[.]dev

This domain, ledger-live-destop-welcome.pages.dev, is flagged for brand impersonation, specifically targeting the cryptocurrency management brand Ledger. The domain poses a significant risk to users who may be tricked into believing it is the official Ledger Live Desktop platform, potentially leading to the theft of sensitive information and financial loss.

Analysis indicates that the domain has been flagged by 10 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. It was registered through Cloudflare, Inc. on September 25, 2025, and resolves to the IP address 188.114.97.3. The domain currently appears on one security blocklist and is blocked by PhishDestroy. The use of an SSL certificate from Google Trust Services and the presence of HSTS and HTTP/3 technologies may give a false sense of security, as these are often employed by legitimate sites but can also be used by malicious actors to enhance the credibility of their phishing attempts.

If users have visited this domain, they should immediately check their Ledger accounts for any unauthorized activity. They should also monitor their financial statements and credit reports for signs of fraud. Users are advised to change their passwords and enable two-factor authentication (2FA) on all relevant accounts. Reporting the incident to Ledger’s official support channels and to local cybersecurity authorities is also recommended to help mitigate the potential damage and assist in the investigation.