ledger-livv-desktop[.]pages[.]dev

PhishDestroy identifies ledger-livv-desktop.pages.dev as an active brand impersonation domain targeting Ledger cryptocurrency wallet users. This site poses a HIGH RISK by masquerading as a legitimate Ledger desktop application installer through a deceptive subdomain structure. The threat is credible due to precise Ledger branding replication and distribution via cloud hosting.

This domain was flagged during routine monitoring due to its explicit impersonation of Ledger, a leading hardware wallet manufacturer. Intelligence confirms the site resolves to Cloudflare IP 172.66.44.193 and currently registers 0 detections out of 95 scanners on VirusTotal. Cloudflare, Inc. acts as both registrar and hosting provider via Pages.dev, enabling rapid deployment and evasion of traditional takedowns. The absence of blocklist entries suggests this threat remains under active reconnaissance by cybersecurity systems.

To mitigate risk, users should immediately avoid accessing ledger-livv-desktop.pages.dev and verify all Ledger downloads through the official ledger.com domain. If accidentally engaged, disconnect devices from the internet, scan for malware using reputable tools, and report the domain to Ledger’s abuse team and PhishDestroy. Cloudflare has been notified to expedite takedown under brand infringement policies.