ledgerlivedesktop-ean[.]pages[.]dev

Analysis of ledgerlivedesktop-ean.pages.dev shows multiple indicators of malicious activity targeting the Ledger brand. The domain was created on 21 February 2026 and registered through Cloudflare, Inc., using Cloudflare’s DNS infrastructure (val.ns.cloudflare.com, jeff.ns.cloudflare.com) and resolving to IP 172.66.44.217, which belongs to AS13335 Cloudflare in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and served an HTTP 403 response, suggesting that the content was either removed or deliberately blocked. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that six of ninety‑three scanned security vendors identified the domain as malicious.

Independent blocklists confirm the presence of the domain on at least one security list, and PhishDestroy has actively taken it offline. Reputation services assign extremely low trust scores: Gridinsoft rates it 0 / 100 and Scamadviser 10 / 100, reinforcing the perception of a high‑risk resource. The SSL certificate is issued by Google Trust Services under the WE1 identifier, a common certificate for Cloudflare‑protected sites, but does not mitigate the observed abuse. The domain is classified as a crypto‑related scam impersonating Ledger, aligning with the brand‑impersonation threat type.

Uncertainty remains around the exact payload or credential‑harvesting mechanisms, as the page content was not captured before the takedown. Defenders should continue to block the domain and its associated IP address, monitor for additional subdomains under the pages.dev namespace that reference Ledger or similar branding, and update intrusion detection signatures to flag HTTP/3 or HSTS traffic originating from Cloudflare‑hosted IP ranges matching this pattern. Ongoing vigilance is advised, given the low trust scores and the presence of the domain on multiple threat intelligence feeds.