ladgr-live-login[.]pages[.]dev

Analysis of the domain ladgr-live-login.pages.dev indicates it was actively impersonating Ledger, a cryptocurrency hardware wallet provider, as of its detection in March 2026. The domain was registered on March 22, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.44.86, hosted by Cloudflare in Canada. The page title, 'Ledger Live Login – Secure Access to Your Crypto,' explicitly targeted users of Ledger’s official platform, suggesting an intent to harvest credentials or sensitive information under the guise of legitimate access. Technical indicators reveal the domain was flagged by 13 of 94 security vendors on VirusTotal, though no further details on specific detection rules are available.

It was also listed on at least one security blocklist (PhishDestroy) and assigned a Gridinsoft trust score of 0/100, reinforcing its classification as malicious. The domain employed Cloudflare nameservers (adele.ns.cloudflare.com and kipp.ns.cloudflare.com) and utilized HTTP/3 and HSTS, which may have been leveraged to evade detection or enhance perceived legitimacy. The SSL certificate was issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. At the time of this report, the domain returns an HTTP 403 status, indicating it is no longer accessible, though this does not preclude the possibility of reactivation or migration to a new infrastructure.

The scam type was classified as a crypto scam, consistent with the impersonation of Ledger’s login portal. Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. Monitoring for similar patterns—such as Cloudflare-hosted domains impersonating crypto-related brands—is recommended to preempt further abuse. No evidence of a phishing kit or additional payloads has been confirmed, and the exact content of the page remains unanalyzed.