stake-desktop-ledgre[.]pages[.]dev

This domain operates as a crypto drainer site impersonating Ledger, a hardware cryptocurrency wallet provider. The page mimics the official Ledger Live desktop application, using the title 'Ledger Live: Desktop — Getting™ Started' to deceive users into interacting with malicious smart contracts. Once connected, the site attempts to drain cryptocurrency assets from victims' wallets by exploiting wallet connection permissions and executing unauthorized transactions. The threat specifically targets users seeking to manage or update their Ledger devices, leveraging brand trust to facilitate asset theft. Analysis indicates the domain stake-desktop-ledgre.pages.dev was registered on May 01, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada. Security vendors on VirusTotal flag this domain as malicious, with 3 out of 95 detections. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The infrastructure is hosted behind Cloudflare, a common tactic to obscure the true origin of phishing sites and evade takedown efforts. Users who visited stake-desktop-ledgre.pages.dev should immediately revoke any wallet connections made to the site and cease all interactions. If cryptocurrency transactions were initiated, affected parties should monitor their wallet activity for unauthorized transfers and report the incident to their wallet provider or relevant blockchain analytics platforms. It is recommended to reset any passwords or recovery phrases associated with the compromised wallet and conduct a security audit of all connected devices. Users should verify the authenticity of Ledger-related communications by accessing the official website directly via verified channels.