us-desktop-live-en[.]pages[.]dev

This domain, us-desktop-live-en.pages.dev, is a confirmed phishing infrastructure designed to impersonate Ledger's official desktop wallet application. Analysis of the page title, "Ledger® Live Desktop — Getting Started," indicates an attempt to deceive users into downloading malicious software or entering cryptocurrency wallet credentials. The site mimics the legitimate Ledger Live interface, a common tactic in cryptocurrency phishing campaigns targeting hardware wallet users. Such attacks often aim to steal recovery phrases, private keys, or install malware to compromise wallet security and drain funds from victims' accounts.

Infrastructure analysis reveals the domain was registered on October 15, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.102. Despite its recent creation, the domain has already been flagged by one security blocklist, specifically PhishDestroy. VirusTotal reports 0 out of 95 detections, suggesting the threat may still be evading widespread detection. The domain uses a Google Trust Services SSL certificate, which provides a false sense of legitimacy to potential victims. Additional technical indicators include a Gridinsoft trust score of 0/100, reinforcing its classification as malicious infrastructure.

Users who visited us-desktop-live-en.pages.dev should immediately cease all interaction with the site and any downloaded files. If credentials or recovery phrases were entered, affected users must transfer assets to a new, secure wallet and revoke access from any connected applications. Devices used to access the site should undergo a full malware scan using updated security tools. Cryptocurrency wallet users are advised to verify domain authenticity by cross-referencing official sources before entering sensitive information. Monitoring for unauthorized transactions and enabling multi-factor authentication on all accounts is strongly recommended to mitigate further risk.