ledgr-live-desk[.]pages[.]dev

The domain ledgr-live-desk.pages.dev was registered on March 28, 2026 and resolves to the Cloudflare IP address 172.66.44.76, indicating that the attacker is leveraging Cloudflare's edge network. The site serves HTTP status 200 and advertises HSTS and HTTP/3 support, with an SSL certificate issued by Google Trust Services under the WE1 label. The page title returned from the server is "Ledger Live Login | Manage Crypto Portfolio," directly referencing Ledger's official service and suggesting a brand impersonation campaign. Infrastructure analysis shows the domain is hosted on Cloudflare's network (nameservers felicity.ns.cloudflare.com and kia.ns.cloudflare.com) and the IP location is listed as CA, consistent with Cloudflare’s global presence. Reputation data is poor: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one public security blocklist, and PhishDestroy has already blocked it. VirusTotal scans report that six of ninety‑four security vendors flag the domain as malicious, reinforcing the suspicion of abuse. The known intelligence does not include any content inspection beyond the page title, so the exact phishing payload or credential capture mechanisms remain unverified. Given the confirmed brand impersonation label, the active status, and the multiple independent detections, defenders should treat this domain as a high‑risk threat. Recommended actions include immediate DNS or firewall blocking of the domain, inclusion of its IP address in network threat feeds, and dissemination of user awareness alerts highlighting the Ledger impersonation attempt. Continuous monitoring of Cloudflare‑hosted subdomains for similar naming patterns is advised to mitigate future campaigns.