ete-ledger-live-desktop[.]pages[.]dev

PhishDestroy identifies a new Ledger brand impersonation campaign hosted at ete-ledger-live-desktop.pages.dev, a Cloudflare Pages domain actively distributing fake Ledger Live Desktop software. The threat type is direct brand impersonation with malicious intent to harvest cryptocurrency wallet credentials and seed phrases. The current risk level is classified as under_investigation due to limited behavioral telemetry, but the presence of an active SSL certificate and zero detections on VirusTotal indicate early-stage evasion tactics against automated detection systems. This domain was flagged by PhishDestroy on 2024-06-05 with the unique seed identifier a3c7b3. The domain resolves to IP address 188.114.97.3 via Cloudflare’s edge network and is served through Google Trust Services’ SSL certificate. VirusTotal currently shows 2/95 detection engines flagging the URL as malicious, suggesting it remains under the radar of most signature-based antivirus platforms. The domain was registered through Cloudflare, Inc. and leverages the .pages.dev subdomain under Cloudflare’s Pages platform, a legitimate service being abused for hosting. The SSL certificate, issued by Google Trust Services, provides a false sense of legitimacy to potential victims. To mitigate exposure to this threat, users should avoid downloading Ledger Live Desktop from third-party domains, including any .pages.dev subdomains. Always verify software sources via the official Ledger website (ledger.com) or trusted app stores. Organizations are advised to block the domain ete-ledger-live-desktop.pages.dev at DNS and network levels, and inspect SSL traffic for connections to 188.114.97.3. If credential compromise is suspected, users should immediately revoke access to Ledger Live and transfer assets to a new wallet using a clean device. Monitor cryptocurrency transaction logs for unauthorized transfers. Report any interaction with this domain to Ledger’s support and local cybersecurity authorities.