leddgr-desktop-live-en[.]pages[.]dev

Security researchers at PhishDestroy have flagged leddgr-desktop-live-en.pages.dev as an active phishing campaign designed to impersonate Ledger's official desktop application interface. This domain leverages Cloudflare Pages to host a convincing replica of the real Ledger Live interface, aiming to harvest sensitive cryptocurrency wallet credentials and personal data from unsuspecting users. Analysis of this domain reveals critical red flags: it currently evades detection with 1 out of 95 VirusTotal engines marking it as malicious, operates under Cloudflare’s infrastructure (registered through Cloudflare, Inc.), and resolves to IP address 172.66.47.178 with an SSL certificate issued by Google Trust Services. The domain’s use of a Cloudflare Pages subdomain (pages.dev) further complicates takedown efforts, as threat actors frequently exploit this service to rapidly deploy and rotate phishing infrastructure. While the exact creation date is not provided, this domain remains actively operational despite its low detection rate, indicating a potentially emerging or highly targeted campaign against Ledger users. If you have visited leddgr-desktop-live-en.pages.dev, immediately disconnect from the internet, scan your device for malware using trusted antivirus software, and revoke any credentials entered on the site. Avoid downloading or running any files from this domain. Report this domain to your security team or via platforms like PhishDestroy, VirusTotal, or Google Safe Browsing to help flag it for others. Remain vigilant for unauthorized transactions or suspicious activity in connected financial accounts. For Ledger users, verify any software downloads or updates directly from the official ledger.com domain to prevent falling victim to this impersonation attempt.