max-ledger-desktop[.]pages[.]dev

This domain, max-ledger-desktop.pages.dev, is identified as a brand impersonation phishing site targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the infrastructure was designed to mimic legitimate Ledger desktop interfaces, likely to harvest user credentials, recovery phrases, or private keys through deceptive input forms. The domain exhibits characteristics consistent with known crypto wallet drainer kits, though no specific kit identifier has been confirmed in this instance. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.146. Security vendor assessments show 12 out of 95 engines on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, a common feature in phishing campaigns leveraging legitimate certificate authorities to appear credible. No Google Safe Browsing (GSB) detection is recorded at this time. The domain has been taken offline, likely following detection and reporting by security researchers or automated systems. While the immediate threat is mitigated, the infrastructure may reappear under a different domain or subdomain. Users who interacted with the site should assume credential exposure and take immediate action, including revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists with the provided indicators and monitor for related domains using similar naming conventions or infrastructure patterns.