support-desktip[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live Desktop platform, likely to distribute malicious software or harvest credentials under the guise of a secure crypto management tool. The specific threat type involves crypto wallet impersonation, which may lead to unauthorized access or asset theft if interacted with. Infrastructure analysis reveals the domain support-desktip.pages.dev was registered on November 7, 2025, through Cloudflare Pages, a platform frequently abused for hosting phishing content. It resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1), providing a false sense of legitimacy. Security vendor detections on VirusTotal stand at 9 out of 95, indicating moderate but growing recognition of the threat. The domain appears on at least one security blocklist and is actively blocked by enterprise phishing detection systems. Despite these indicators, the site remains operational, increasing exposure risk to unsuspecting users. Mitigation requires immediate action from security teams and end users. Organizations should update web filtering rules to block access to support-desktip.pages.dev and monitor for related indicators of compromise. Users who may have visited the site should verify the authenticity of any downloaded software through official Ledger channels and check for unauthorized transactions on connected wallets. Given the high-risk nature of crypto wallet impersonation, affected individuals should assume credential exposure and rotate access keys or seed phrases using a secure, offline device. Security teams are advised to correlate this domain with other Ledger-themed phishing campaigns and assess potential lateral movement within compromised environments.