# PhishDestroy threat dossier — ladger-live-desktops.pages.dev ================================================================ Fetched: 2026-04-26 07:13:42 UTC Canonical: https://phishdestroy.io/domain/ladger-live-desktops.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 97/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, CyRadar, G-Data, Kaspersky, LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: bill.ns.cloudflare.com, mira.ns.cloudflare.com Registered: 2026-04-06 Page title: Ledger Live Desktop — Official Guide HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-05 Status: INVALID chain Fingerprint: 9bcbc9d29c04f155ad928c24ba925b9e5f7e4f3f9cd0efe93cbbaf580fac26ea ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-06 16:51:53 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:07:17 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d630e-691e-7566-945e-8124dd1f49c9/ Wayback Machine: https://web.archive.org/web/*/ladger-live-desktops.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.ladger-live-desktops.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=ladger-live-desktops.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/ladger-live-desktops.pages.dev URLhaus: https://urlhaus.abuse.ch/host/ladger-live-desktops.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-06 16:52:21 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies ladger-live-desktops.pages.dev as an active phishing domain impersonating the legitimate Ledger Live desktop application, aiming to deceive users into downloading malicious software or entering sensitive wallet credentials. This domain was flagged through automated analysis and user reports after it began circulating in crypto communities as a spoofed download page for Ledger’s official desktop client. The threat actor leveraged Cloudflare Pages to host the fake site, exploiting the platform’s reputation to evade immediate detection. The domain currently resolves to IP 188.114.96.3 and uses a Google Trust Services SSL certificate to appear legitimate, increasing the likelihood of successful deception. This domain poses a high-risk threat to cryptocurrency users, particularly those using Ledger hardware wallets, as it mimics a trusted application interface. Technical indicators include registration through Cloudflare, Inc., which provides anonymity and rapid deployment capabilities, and a current VirusTotal detection rate of 0 out of 95 security engines, indicating it remains undetected by major antivirus and threat intelligence platforms. While the domain is under investigation, its active status and clean reputation on VirusTotal make it especially dangerous to unsuspecting users. The use of a Google-issued SSL certificate (CN: *.pages.dev) further enhances its credibility, as browsers display the padlock icon, reinforcing false trust. Given the domain’s recent deployment and lack of blocklist entries, it represents a rapidly evolving threat capable of capturing sensitive data such as private keys, recovery phrases, or login credentials. Users who have visited ladger-live-desktops.pages.dev should immediately cease any interaction with the site and scan their devices using updated antivirus and anti-malware tools. If any credentials were entered or software downloaded, disconnect from the internet, revoke session tokens, and transfer funds to a newly generated wallet address from a trusted device. Report the domain to your security team or platform provider (e.g., Ledger Support, Google Safe Browsing) and avoid clicking any links or downloading files from similar URLs. Enable multi-factor authentication on all crypto-related accounts and verify download sources only through official channels. Monitor financial accounts and wallet balances for suspicious activity. This domain is expected to be added to global threat intelligence feeds shortly; vigilance and rapid response are critical to mitigating potential losses. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 9bcbc9d29c04f155ad928c24ba925b9e5f7e4f3f9cd0efe93cbbaf580fac26ea ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/ladger-live-desktops.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=ladger-live-desktops.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io