help-ledgr-desktop-li[.]pages[.]dev

This domain, help-ledgr-desktop-li.pages.dev, is flagged as a high-risk phishing infrastructure targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site employs brand impersonation tactics, presenting itself as the legitimate Ledger Live Desktop application with the page title 'Ledger Live Desktop - Secure Crypto Management.' The infrastructure appears designed to deceive users into entering sensitive credentials or wallet recovery phrases, likely funneling stolen assets to attacker-controlled addresses. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 09, 2025, through Cloudflare Pages and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns to appear legitimate. Detection metrics show 10 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. No legitimate association with Ledger or its official services has been established. As of the latest verification, the domain remains active and continues to host the phishing content. Users who interacted with this site are advised to immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolving IP address. Despite takedown efforts, the risk of credential theft and financial loss persists due to the domain's continued operation and sophisticated impersonation techniques.