ledger-live-desktop-pc[.]pages[.]dev

The domain ledger-live-desktop-pc.pages.dev was registered through Cloudflare on February 21, 2026 and resolves to the Cloudflare‑owned address 188.114.96.3, ASN 13335 located in the United States. The site presented the Cloudflare page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status, indicating that access was deliberately blocked. SSL is provided by Cloudflare TLS Issuing ECC CA 3, and the site enforced HSTS while supporting HTTP/3, confirming the use of modern Cloudflare infrastructure. Reputation metrics are extremely low: Scamadviser assigns a trust score of 1 / 100, Gridinsoft a score of 0 / 100, and the domain appears on a single security blocklist.

VirusTotal analysis recorded 12 detections out of 93 scanning engines, reinforcing the malicious classification. The phishing kit is identified as a crypto‑related scam targeting Ledger users, and the domain has been flagged by PhishDestroy as a blocked entry. Nameservers kyrie.ns.cloudflare.com and nucum.ns.cloudflare.com further tie the domain to Cloudflare’s automated provisioning system.

The site is currently offline, which limits real‑time observation of its content, but the combination of low trust scores, multiple vendor detections, and the explicit "Suspected phishing site" title provides strong evidence of brand impersonation. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the exact hostname, and monitor for any resurgence of activity from the same IP or adjacent subdomains. Additional investigation could focus on any associated C2 domains or payloads linked to the 12 VirusTotal detections, though the current evidence already warrants a high‑confidence elevation of risk for this Ledger impersonation attempt.