secure-desktop-ladgar[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically designed to deploy crypto drainers. Analysis indicates the domain mimics Ledger, a hardware wallet provider, to deceive users into interacting with malicious software that siphons cryptocurrency from connected wallets. The threat type is narrowly defined as a crypto drainer, not generic phishing, due to its targeted exploitation of wallet management applications. Infrastructure analysis reveals the domain secure-desktop-ladgar.pages.dev resolves to IP 172.66.44.101, registered through Cloudflare, Inc., with an IP geolocation in Canada. The domain was created on March 23, 2026, and remains active. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist and is blocked by PhishDestroy. The page title, "Ledger® Live: Desktop® || Simple,Secure Management App," directly impersonates the legitimate Ledger Live application. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP at the network perimeter. Users should verify the authenticity of any Ledger-related software by accessing it exclusively through the official Ledger website or verified app stores. Wallet connections should be audited for unauthorized transactions, and hardware wallets should be reset if exposure is suspected. Security teams should monitor for outbound connections to 172.66.44.101 and alert on any attempts to access secure-desktop-ladgar.pages.dev. Endpoint detection rules should be updated to flag processes attempting to interact with this domain or its associated SSL certificate.