ledgerlive--desktop--run[.]pages[.]dev

PhishDestroy identifies ledgerlive--desktop--run.pages.dev as an active credential theft page impersonating the Ledger hardware wallet brand to harvest cryptocurrency account credentials.

This domain is hosted on 172.66.47.158 and terminates an SSL certificate issued by Google Trust Services. The page is registered through Cloudflare, Inc. using a Pages.dev subdomain designed to mimic the legitimate Ledger Live desktop application URL space. Threat intelligence shows zero VirusTotal detections (3/95 engines) and the site remains unlisted on Google Safe Browsing and major threat blocklists at time of analysis.

Current status places the domain under active analysis with a status of active. The low VT detection rate (3/95) suggests security engines have not yet fingerprinted the malicious payload or delivery chain. While no drainer kit artifacts or dropper scripts have been publicly shared, the domain’s spoofing of “Ledger” within a Pages.dev subdomain strongly correlates with a credential harvesting objective targeting cryptocurrency users. Remaining risk is medium due to unchecked propagation and absence of blocklist coverage. Users should block the domain at DNS/host level, refrain from entering credentials, and report the domain to threat intelligence platforms via PhishDestroy or URLScan feeds.