connect-desktop-ldgerlive[.]pages[.]dev

This domain, connect-desktop-ldgerlive.pages.dev, has been identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live Desktop application, presenting itself under the title "Ledger Live Desktop® | Secure Your Crypto™ Assets®" to deceive users into interacting with fraudulent content. As of the latest assessment, the domain is currently offline, though prior activity suggests it was operational for malicious purposes. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. Despite its deceptive appearance, the domain has not been flagged by any of the 95 security vendors on VirusTotal, a notable discrepancy given its impersonation of a high-profile cryptocurrency brand. Infrastructure analysis reveals the use of HTTP/3 and HSTS, alongside a Google Trust Services SSL certificate, which may lend an air of legitimacy to unsuspecting users. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, further confirming its malicious nature. The creation date of April 30, 2026, is anomalous, suggesting either a typo in registration records or an attempt to obscure its true age. The current offline status of connect-desktop-ldgerlive.pages.dev does not eliminate the risk posed by similar domains or potential future reactivation. Organizations and individuals are advised to block the domain and its associated IP address (188.114.97.3) at the network level. Users should verify the authenticity of any Ledger-related domains by cross-referencing with the official Ledger website and avoiding interaction with unsolicited links. Security teams are encouraged to monitor for related infrastructure, such as domains registered under the same registrar or resolving to the same IP range, to preemptively mitigate further threats.