This site impersonates Ledger Live, the desktop companion app for Ledger hardware wallets. The doubled "g" in "ledgger" and the "app-desktop" wording are aimed at people searching for the official download. PhishDestroy first saw it on 2026-09-08. It has been offline since 2026-09-16, and as of 2026-10-19 the hosting provider is still blocking its content.
How the scam works
Fake Ledger Live pages usually offer a counterfeit download or a "sync" or "recovery" screen that asks for the 24-word recovery phrase. Anyone who types those words into a website or a fake app hands over full control of every account the device secures, and the funds can be drained without the hardware wallet ever being touched. The page now displays the title "Suspected Phishing | Cloudflare", which is the provider's warning interstitial rather than the original lure, while our classification is Ledger impersonation.
Evidence
On 2026-09-18, VirusTotal showed 14 of 89 engines flagging the address. The flagging vendors include alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft, so the verdict comes from several unrelated detection stacks. urlscan.io rated it malicious, though the only brand it detected was a generic Cloudflare page, consistent with the warning screen now in place. The domain is also on the MetaMask and SEAL blocklists alongside PhishDestroy.
Infrastructure
The address is a free Cloudflare Pages subdomain, so there was no domain to register and no purchase cost. That makes this kind of throwaway lookalike quick to launch and easy to replace. It resolved to Cloudflare, Inc. network space geolocated to Canada. The roughly eight days between our first sighting on 2026-09-08 and the takedown on 2026-09-16 match the short lifespan typical of disposable impersonation pages.
What to do
If you entered your recovery phrase here, treat it as compromised. Set up the Ledger device with a brand-new phrase and move your funds to the new accounts immediately, before anyone else does. If you downloaded an installer from this site, delete it, run a full malware scan, and reinstall Ledger Live only from Ledger's official website; Ledger never asks for your 24 words. If you connected a wallet, review and revoke any unfamiliar token approvals. Defenders should block this pages.dev hostname and watch for similar misspelled Ledger subdomains on free hosting platforms.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
