ldgrliv-desk[.]pages[.]dev

Analysis of the domain ldgrliv-desk.pages.dev indicates an active brand-impersonation phishing campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on March 26, 2026, through Cloudflare, Inc., resolves to the IP address 172.66.47.54. Infrastructure analysis reveals the use of Cloudflare hosting and Google Trust Services for SSL certification, with HTTP/3 and HSTS technologies detected. The page title, 'Ledger Live Desktop® — Secure Crypto Management™ Platform,' directly mirrors Ledger’s official branding, suggesting an intent to deceive users into believing the site is legitimate. As of July 12, 2026, the domain appears on one security blocklist and is flagged by 12 of 95 security vendors in a recent scan, indicating moderate detection coverage. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the domain remains operational, defenders should prioritize blocking or monitoring traffic to 172.66.47.54 and the associated domain to mitigate potential credential harvesting or cryptocurrency-related fraud. The exact phishing kit or payload delivery mechanism has not yet been analyzed, but the combination of brand impersonation and cryptocurrency targeting aligns with known attack patterns. Organizations are advised to update detection rules to include this domain and IP, particularly in environments where Ledger-related services are accessed.