legdre-live-desktop[.]pages[.]dev

This domain presents an elevated risk due to its specific threat type: brand impersonation targeting Ledger, a popular cryptocurrency hardware wallet provider. The site was designed to deceive users into believing they were accessing legitimate Ledger Live Desktop software, potentially leading to credential theft or cryptocurrency loss. Although currently offline, the domain's history and indicators suggest it was a well-crafted phishing attempt.

PhishDestroy identified that legdre-live-desktop.pages.dev was flagged by 8 out of 95 security vendors on VirusTotal, indicating moderate but concerning detection. The domain was registered on April 20, 2026, through Cloudflare, Inc., and resolved to IP address 188.114.96.3. It appeared on one security blocklist and used an SSL certificate from Google Trust Services (WE1). The page title was "Ledger® Live Desktop – Manage Cryptocurrency Securely," which closely mimics the official Ledger Live branding. Despite being taken offline, the domain's creation date and registration details suggest it was set up specifically for malicious purposes.

To protect against such threats, users should always verify domain names before entering credentials or downloading software. Official Ledger applications are only available through the official Ledger website (ledger.com) or authorized app stores. Enabling two-factor authentication, using hardware wallets, and regularly monitoring cryptocurrency accounts can mitigate risks. If users have interacted with this domain, they should change their Ledger passwords immediately and enable additional security measures. PhishDestroy recommends reporting any similar domains to security teams and blocklisting the IP 188.114.96.3 and domain pattern *pages.dev associated with Ledger impersonation.