desktop-app-ledger[.]pages[.]dev

Analysis of the domain desktop-app-ledger.pages.dev indicates an active brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on October 23, 2025, through Cloudflare, Inc., currently resolves to the IP address 172.66.44.53. Infrastructure analysis reveals the use of Cloudflare hosting and security technologies, including HSTS and HTTP/3, alongside an SSL certificate issued by Google Trust Services. The page title, 'Ledger Live Desktop | Your All-in-One Crypto Wallet App,' directly mimics official Ledger branding, suggesting an intent to deceive users into interacting with fraudulent wallet software. As of July 12, 2026, the domain remains active and is flagged on at least one security blocklist, specifically PhishDestroy. Detection metrics from VirusTotal report that 9 out of 95 security vendors classify this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The combination of brand impersonation, low trust scores, and active blocklist presence elevates the risk level to high. Defenders are advised to treat this domain as a confirmed phishing threat and implement blocking measures at the network and endpoint levels. Further investigation into associated infrastructure, such as the resolving IP and Cloudflare account, may reveal additional linked domains or campaigns. The exact content and functionality of the site have not yet been analyzed, but the available evidence strongly supports its classification as a fraudulent Ledger impersonation.