ledgerlivedesktop[.]live

Analysis on 24 July 2026 identifies ledgerlivedesktop.live as a brand‑impersonation site targeting Ledger users. The page title returned from the server reads “Ledger Live Desktop – Download & Install Ledger Live Desktop App”, which directly references Ledger’s official desktop application. The domain is registered through Cloudflare, Inc., and its authoritative nameservers are megan.ns.cloudflare.com and pedro.ns.cloudflare.com, indicating that the hosting infrastructure is provided by Cloudflare. DNS resolution points to the IP address 172.67.218.251, an address belonging to AS13335 Cloudflare, Inc., located in the United States.

An SSL certificate issued by Google Trust Services under the WE1 root is present, confirming that the site uses a valid TLS certificate despite its malicious intent. Network‑level checks show the domain is currently offline, returning an HTTP 403 status code, and it has been taken down from public access. Nevertheless, the site was previously flagged by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal analysis recorded 11 of 95 security vendors labeling the domain as malicious, providing independent corroboration of the threat.

The site is classified as a crypto‑scam, and the impersonated brand is explicitly Ledger, as indicated in the known intelligence. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been hosted before the takedown, as no page content has been captured in the public record. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host name or associated IP ranges, and update endpoint detection rules to flag attempts to access the URL path that previously served the Ledger Live Desktop download page. Threat intelligence feeds should be enriched with the observed nameserver and certificate details to improve future detection of similarly provisioned impersonation campaigns.