ledger-liveddesktop[.]pages[.]dev

PhishDestroy identifies ledger-liveddesktop.pages.dev as an active brand impersonation domain targeting Ledger users. The page masquerades as a legitimate Ledger Live Desktop portal but is designed to siphon cryptocurrency assets via deceptive credential and wallet seed extraction flows. No crypto drainer kit artifacts (e.g., clipboard modification, wallet address spoofing scripts) have been extracted yet, but the page layout and JavaScript payloads closely mimic the official Ledger Live interface to maximize deception. This domain was flagged with 0 detections out of 95 VirusTotal engines, registered through Cloudflare, Inc., resolving to IP 188.114.97.3. The SSL certificate is issued by Google Trust Services, and the domain was created recently with no publicly listed creation date; it remains unblocked by Google Safe Browsing as of this report. It currently appears on zero known threat intelligence blocklists. The domain is under active investigation with a status marked as 'active'. Users should block access at the network or DNS level and avoid clicking links from unsolicited emails or ads. Remaining risk includes potential zero-day evasion of detection tools and rapid infrastructure rotation via Cloudflare’s proxy network. Immediate mitigation includes DNS sinkholing and browser policy updates to block *.pages.dev wildcard domains associated with impersonation campaigns.