live-ledgr-dekstop[.]pages[.]dev

This domain, live-ledgr-dekstop.pages.dev, has been identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as an official Ledger Live integration portal under the title 'Ledger Live Integrations | Secure Crypto Ecosystem Connections,' designed to deceive users into disclosing sensitive credentials or installing malicious software. As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to exploit trust in the Ledger brand for fraudulent purposes. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain is flagged by 12 of 95 security vendors on VirusTotal, a notable detection rate that underscores its classification as a high-confidence threat. It was registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, a Cloudflare-operated endpoint commonly used for both legitimate and malicious content distribution. The domain appears on at least one security blocklist, further corroborating its association with phishing infrastructure. The SSL certificate is issued by Google Trust Services, a detail that may lend a false sense of legitimacy to unsuspecting users. The domain was created on April 18, 2026, though this date may reflect a typo or misconfiguration in registration records, as it postdates the current year. Gridinsoft assigns the domain a trust score of 0 out of 100, indicating a complete lack of credibility. The current status of live-ledgr-dekstop.pages.dev is offline, suggesting either takedown by the hosting provider or voluntary cessation by the threat actor. However, the infrastructure and tactics observed are consistent with ongoing phishing campaigns targeting cryptocurrency users. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with the site should immediately revoke any connected wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Security teams are encouraged to review logs for connections to 188.114.96.3 and correlate with other Ledger-themed phishing indicators. Proactive monitoring for similar domains using variations of 'ledger' and 'live' is recommended to mitigate future risks.