desktop-faq-leggr[.]wasmer[.]app

This domain, desktop-faq-leggr.wasmer.app, is flagged for brand_impersonation phishing activity targeting Ledger, a hardware cryptocurrency wallet provider. The phishing page mimics the official Ledger Live Desktop application, as evidenced by the page title 'Ledger Live Desktop® | Official Ledger Mobile & Desktop App.' No specific drainer kit signatures were identified in the available telemetry, but the domain exhibits characteristics consistent with credential harvesting and cryptocurrency wallet compromise attempts. Infrastructure analysis reveals the following technical indicators: the domain was registered through Wasmer on June 12, 2026, and resolves to the IP address 62.210.172.162. Detection metrics indicate that 20 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing (GSB) databases. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains due to its accessibility and automation. As of the latest assessment, desktop-faq-leggr.wasmer.app has been taken offline, likely in response to security vendor detections and blocklist inclusions. The domain was proactively blocked by PhishDestroy, reducing immediate exposure risk. However, residual risk persists due to the potential for infrastructure reuse or re-registration under a similar naming scheme. Users who may have interacted with this domain are advised to revoke any connected wallet sessions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.