live-desktup-connect[.]pages[.]dev

This domain, live-desktup-connect.pages.dev, is flagged for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live Desktop interface, presenting a login page titled 'Ledger Live Desktop — Secure Login' to deceive users into submitting sensitive credentials or recovery phrases. No direct evidence of a crypto drainer kit has been observed, but the infrastructure aligns with credential harvesting tactics commonly used to compromise cryptocurrency wallets. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.175. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3 protocols, likely to enhance perceived legitimacy. VirusTotal reports zero detections out of 95 engines, indicating the domain has not yet been widely flagged. However, it appears on one security blocklist, and Gridinsoft assigns a trust score of 0/100, reflecting high-risk classification. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the site should assume potential credential exposure and take immediate action, including revoking access to any linked wallets, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to mitigate future threats. The low detection rate underscores the need for continuous monitoring of newly registered domains under similar naming conventions.