live-en-desktop-us-ayq[.]pages[.]dev

This domain, live-en-desktop-us-ayq.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live Desktop application, presenting itself as a legitimate platform for securing digital assets. Infrastructure analysis reveals no direct evidence of a crypto drainer kit, but the page title, 'Ledger Live Desktop – Secure Your Digital Coins,' and domain structure strongly suggest an intent to deceive users into downloading malicious software or entering sensitive credentials. Technical indicators confirm the domain's malicious nature. It holds a VirusTotal detection score of 8/95, with multiple security vendors flagging it as malicious. The domain was registered on April 03, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.99, hosted on Cloudflare’s infrastructure in Canada. It appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services (WE1). Despite these red flags, the domain remains active and unlisted on Google Safe Browsing as of the latest assessment. The current status of the domain remains active, posing an ongoing risk to users who may mistake it for the legitimate Ledger Live platform. Recommended response actions include immediate blacklisting by network security tools, browser-based warnings for users attempting to access the site, and public disclosure to alert the cryptocurrency community. While the domain is hosted on a reputable content delivery network, the combination of brand impersonation, blocklist inclusion, and vendor detections underscores the need for heightened vigilance. Users are advised to verify domain authenticity through official channels before interacting with any Ledger-related services.