ledgerdesktop[.]live

This domain, ledgerdesktop.live, is a credential harvesting site designed to impersonate Ledger Live, the official software for managing Ledger hardware wallets. The infrastructure targets cryptocurrency users by presenting a fraudulent interface that mimics the legitimate Ledger Live application, tricking victims into entering sensitive wallet credentials, recovery phrases, or private keys. The page title explicitly displays 'Ledger Live,' reinforcing the deception, while the use of Vercel hosting and HSTS headers attempts to lend an air of legitimacy to the operation. Such attacks are commonly used to gain unauthorized access to cryptocurrency wallets, leading to immediate asset theft or long-term compromise of associated accounts.

Analysis of the domain reveals multiple indicators of malicious intent. The domain was registered on April 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. Security vendors on VirusTotal flagged the domain as malicious, with 19 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. The site resolves to the IP address 216.198.79.1, which has been linked to other fraudulent activities. Scamadviser and Gridinsoft both assigned the domain a trust score of 1/100 and 0/100, respectively, further confirming its malicious nature.

Users who visited ledgerdesktop.live or entered credentials on the site should take immediate action to mitigate potential compromise. First, disconnect any devices that interacted with the site from the internet to prevent further data exfiltration. Next, assume that any credentials, recovery phrases, or private keys entered are compromised and immediately transfer assets to a new, secure wallet. Enable multi-factor authentication on all associated accounts, including email and exchange platforms, and monitor for unauthorized transactions. Additionally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Finally, report the incident to the legitimate Ledger support team and relevant cybersecurity authorities to aid in tracking and disrupting the infrastructure.