ledger-live-desktops[.]com

On July 22, 2026 the domain www.ledger-live-desktops.com was observed as an offline infrastructure used to impersonate the Ledger brand. The site was registered on March 22, 2026 through Hello Internet Corp and is served by Cloudflare nameservers finley.ns.cloudflare.com and rachel.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to Cloudflare, Inc. and is geolocated to Canada. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 intermediate, indicating the use of a legitimate certificate authority to increase perceived trust.

The page title returned by the server is "www.www.www.ledger-live-desktops.com", but no further content analysis is available. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal has recorded three positive detections out of ninety‑four scanned vendors, confirming that multiple security products consider the domain malicious. The domain is classified as a crypto scam, aligning with the Ledger brand impersonation.

Because the site is currently offline, active mitigation focuses on preventive controls: security appliances should deny traffic to the IP 188.114.96.3, block the domain via DNS or URL filtering, and add the associated nameservers to watchlists for any future re‑use. Threat intelligence feeds should be updated to reflect the registration details, SSL issuer, and the three VirusTotal detections. Continuous monitoring of Cloudflare‑hosted infrastructure for similar patterns is advised, as the same hosting provider is frequently leveraged for rapid phishing deployments.