ledgerlive-deskto[.]pages[.]dev

Analysis of the domain ledgerlive-deskto.pages.dev indicates it is a fraudulent site impersonating Ledger, a well-known cryptocurrency hardware wallet provider. The domain was registered on March 22, 2026, and is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.78, located in Canada. As of July 23, 2026, the domain is offline, returning an HTTP 403 status, which may suggest takedown actions or temporary suspension by the hosting provider. Security vendors have flagged this domain, with 12 out of 94 engines on VirusTotal detecting it as malicious. It appears on at least one security blocklist and is explicitly blocked by PhishDestroy.

The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as a high-risk site. The page title, 'ledger live desktop,' directly aligns with Ledger’s legitimate software, suggesting an intent to deceive users into believing they are accessing an official download or service portal. Infrastructure analysis reveals the use of Cloudflare nameservers (ara.ns.cloudflare.com and damon.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are commonly employed to enhance security but can also be leveraged by threat actors to lend credibility to malicious sites. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not validate the site’s authenticity.

The domain is classified as a crypto scam, targeting users of Ledger’s services, likely aiming to steal credentials, private keys, or install malicious software. Defenders should treat this domain as confirmed malicious and ensure it is blocked at the network level. Users who may have interacted with this site should be advised to revoke any associated wallet permissions, change passwords, and scan their devices for malware. Given the domain’s current offline status, further monitoring is recommended to detect any resurgence or migration to alternative infrastructure.