web-ledgr-desktop[.]pages[.]dev

The phishing domain web-ledgr-desktop.pages.dev impersonates the cryptocurrency wallet brand Ledger. It was first detected on 2026-05-06 and has since been taken offline. At the time of detection, 3 out of 91 vendors on VirusTotal flagged it as malicious, while it also appeared on one public blocklist, specifically PhishDestroy's.

This domain was registered through Cloudflare, Inc., and hosted on an IP address located in Canada, also managed by Cloudflare, Inc. The site used an SSL certificate issued by Google Trust Services, which is a common tactic to lend legitimacy to fraudulent sites. The domain's page title, "Ledger Live Desktop – Secure Crypto Portfolio," was designed to deceive users into believing they were accessing a legitimate Ledger service.

Phishing domains like web-ledgr-desktop.pages.dev exploit the critical time window between domain registration and the propagation of detection data to antivirus databases, which can take 24-72 hours. PhishDestroy's detection pipeline operates upstream of antivirus vendors, allowing it to capture such threats during this vulnerable period. Despite the domain's offline status, its initial activity underscores the need for continuous monitoring and rapid response to emerging threats.