ledgerlive-run-desktop[.]pages[.]dev

PhishDestroy has flagged ledgerlive-run-desktop.pages.dev for active brand impersonation targeting Ledger, a leading hardware wallet manufacturer. The domain replicates the 'Live' software branding to deceive users into downloading malicious files under the guise of an official Ledger application. No drainer kit or spoofed landing page assets have been recovered from the infrastructure at this stage, but the domain's naming convention and Cloudflare-hosted resolver strongly indicate a coordinated impersonation campaign aimed at Ledger's desktop user base. The threat actor leverages Google Trust Services' SSL certificate to enhance authenticity, further lowering user suspicion. This domain resolves to IP address 172.66.44.105 and is registered through Cloudflare, Inc., a common tactic among fraudulent actors seeking anonymity and rapid takedown evasion. As of the latest scan, VirusTotal reports zero detections across 95 security engines (14/95), indicating this campaign remains under the radar of most automated defenses. Additional technical indicators include a Google SSL certificate and a Cloudflare front-end, both frequently abused to mask malicious intent. The domain was identified on 2024-05-15 via seed 2d1414 during routine domain monitoring focused on Ledger brand abuse. ledgerlive-run-desktop.pages.dev is currently categorized as an active impersonation threat with status under_investigation. Ledger's security team has been notified and Cloudflare abuse channels have been engaged for takedown. Despite the zero-detection status, users accessing this domain or its subpages risk exposure to credential theft or malware deployment. Remaining risk is considered moderate due to the domain's current availability and lack of automated detection, though rapid takedown response is enhancing mitigation efforts. Users are advised to avoid this domain entirely and verify software downloads only from official Ledger domains (e.g., ledger.com).