ledgerlivesdekstop-step[.]pages[.]dev

PhishDestroy identifies an active brand impersonation phishing domain, ledgerlivesdekstop-step.pages.dev, impersonating Ledger hardware wallet services. This domain is part of a campaign leveraging typo-squatting and deceptive branding to deceive users into disclosing sensitive cryptocurrency wallet credentials or installing malicious drainer software. While the domain currently evades detection with a 3/95 VirusTotal score, behavioral analysis suggests live operational deployment aimed at Ledger users under the guise of technical support or firmware updates.

Exact technical indicators include a Google Trust Services SSL certificate, Cloudflare registration, and resolution to IP 172.66.47.78. This domain is hosted on Cloudflare Pages, a legitimate platform often abused by threat actors to rapidly deploy phishing landing pages with minimal infrastructure cost. With no current placement on Google Safe Browsing (GSB) blocklists and zero VirusTotal detection, this campaign remains under the radar despite targeting a high-value cryptocurrency brand. The domain was created recently and remains unlisted in major threat intelligence feeds, increasing the risk of successful user compromise.

The campaign status is ACTIVE and under continuous investigation by PhishDestroy. Response actions include domain takedown requests filed with Cloudflare Trust & Safety and coordination with Ledger’s abuse teams. While immediate mitigation is in progress, the absence of blocklist entries and high VT detection evasion introduce a significant residual risk. Users are strongly advised to verify website URLs, avoid clicking unsolicited links, and consult Ledger’s official communication channels when prompted for sensitive actions.