ledger-live-app-deesktop[.]pages[.]dev

This domain operates as a brand impersonation phishing site targeting Ledger Live users. The page mimics the official Ledger Live crypto wallet application, presenting itself under the title 'Ledger Live Crypto Wallet App — Secure, Feature-Rich, and Future-Ready.' The site is designed to harvest login credentials, recovery phrases, or other sensitive authentication details from victims under the false pretense of accessing a legitimate wallet management platform. Given the high-value target—cryptocurrency users—this campaign poses a severe risk of financial theft and unauthorized account access. Analysis indicates the domain was registered through Cloudflare, Inc., with a creation date of April 30, 2026, which may be anomalous or falsified. It resolves to the IP address 172.66.44.126, hosted in Canada under Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s content delivery network. Security vendor detection on VirusTotal stands at 3 out of 95, suggesting limited but growing awareness of the threat. The domain appears on one security blocklist and is actively blocked by at least one anti-phishing system. Users who have visited ledger-live-app-deesktop.pages.dev should immediately cease all interaction and assume their credentials or recovery phrases may be compromised. Any entered information should be treated as exposed, and users are advised to transfer assets from potentially compromised wallets to new, secure wallets using a clean device. Enable multi-factor authentication where available, and monitor all linked accounts for unauthorized transactions. Report the domain to relevant security teams and consider submitting suspicious URLs to threat intelligence platforms for broader awareness and mitigation.