dekstop-en-us-ledger-live[.]pages[.]dev

PhishDestroy identifies dekstop-en-us-ledger-live.pages.dev as an active brand-impersonation site that lures cryptocurrency users by masquerading as the official Ledger Live Desktop application. The page is specifically crafted to mimic the Ledger brand and promises a fake “Manage Your Crypto™ Assets Safely” interface, aiming to steal credentials or install malware when victims attempt to download or log in. This is a targeted social-engineering campaign against Ledger users who rely on desktop software for asset management.

This domain was flagged by PhishDestroy researchers on receipt of seed ddaf4b, revealing it resolves to IP 188.114.96.3 within Cloudflare’s infrastructure. Security scans at VirusTotal currently return 0 detections out of 95 engines, indicating it evades most antivirus signatures. The SSL certificate is issued by Google Trust Services, leveraging Cloudflare’s free pages.dev service to disguise its malicious nature under a legitimate-looking subdomain. At the time of analysis, the page remains actively accessible, suggesting ongoing operation or rapid churn of infrastructure.

If you visited dekstop-en-us-ledger-live.pages.dev or entered any information, disconnect the device from the internet immediately and run a full antivirus scan. Never use saved bookmarks for Ledger Live; always navigate via ledger.com or the official app store. Change Ledger account passwords using a known-safe device and enable two-factor authentication. Report the domain to your IT team or to PhishDestroy via the seed ddaf4b for takedown tracking. Monitor financial accounts for unauthorized transactions linked to the visit timestamp.