ladgr-lives-desktop[.]pages[.]dev

The domain ladgr-lives-desktop.pages.dev is presently active and serves a page whose title reads “Ledger Live Desktop | Complete Desktop Crypto Management Platform”. The title directly references Ledger’s official product line, confirming the campaign’s intent to impersonate the Ledger brand. The site is hosted behind Cloudflare’s network; DNS resolution points to IP 172.66.46.220 located in Canada and the registrar record lists Cloudflare, Inc. as the registrant. The domain was created on 06 April 2026 and uses Cloudflare’s default nameservers jean.ns.cloudflare.com and tony.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating a valid HTTPS connection, which may increase user trust.

HTTP probing returns a 200 status code, confirming that the web server delivers content without redirection. The page has been flagged by 13 of 94 security scanners on VirusTotal, reflecting a moderate detection rate among industry tools. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist, PhishDestroy, demonstrating that at least one reputable anti‑phishing feed is already blocking it. No additional public intelligence such as OTX or Safe Browsing entries is currently available, leaving the broader ecosystem exposure uncertain.

Defenders should treat this domain as high‑risk, given the confirmed brand impersonation of Ledger and the active status of the site. Recommended actions include adding the domain to internal blocklists, configuring web filtering gateways to deny or warn on any request to ladgr‑lives‑desktop.pages.dev, and monitoring DNS logs for queries to the associated Cloudflare nameservers. Incident response teams should also review any recent authentication attempts or credential submissions to Ledger services that may have originated from this host. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge as the campaign progresses.