cloud-desktop-live-leg[.]pages[.]dev

Analysis of the domain cloud-desktop-live-leg.pages.dev indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on April 24, 2026, resolves to 188.114.97.3 and is hosted behind Cloudflare infrastructure, as evidenced by its nameservers (cartman.ns.cloudflare.com and opal.ns.cloudflare.com) and SSL certificate issued by Google Trust Services (WE1). The page title, 'Ledger Live Desktop | Securely Manage Your Crypto Portfolio,' directly mimics Ledger's official desktop application, reinforcing the likelihood of malicious intent. Infrastructure analysis reveals the use of HTTP/3 and HSTS, common in modern phishing campaigns to lend an appearance of legitimacy. The domain is flagged by three of 94 security vendors on VirusTotal, though this detection rate alone does not confirm widespread recognition. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, specifically PhishDestroy. The HTTP status returns 200, confirming the site is currently active and serving content. While the exact payload or distribution method remains unconfirmed, the combination of brand impersonation, recent registration, and low detection rates suggests a targeted campaign. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments handling cryptocurrency transactions. Further investigation into associated IP ranges or certificate reuse may uncover additional infrastructure linked to this threat actor. No evidence currently indicates compromise of Ledger's official systems, and the impersonation appears limited to this domain.