ledger-live-dsk[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic legitimate Ledger Live software, likely to harvest credentials or deploy crypto-draining malware. The specific threat type—brand impersonation—exploits user trust in the Ledger brand to facilitate unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain ledger-live-dsk.pages.dev was registered on April 3, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.10. The SSL certificate is issued by Google Trust Services, a common characteristic of phishing infrastructure leveraging legitimate certificate authorities. Detection metrics show 10 out of 95 security vendors flagged the domain on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was proactively blocked by PhishDestroy. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification, as Cloudflare Pages often hosts transient phishing campaigns. Mitigation measures for this threat type include immediate blocking of the domain and associated IP (172.66.47.10) at the network perimeter. Users who may have interacted with the site should revoke any active Ledger Live sessions, rotate credentials, and verify wallet integrity using official Ledger channels. Organizations should monitor for indicators of compromise, such as unexpected outbound connections to 172.66.47.10 or anomalous authentication attempts. Given the domain's current offline status, defenders should remain vigilant for re-registration attempts under similar naming conventions or infrastructure.