desktop-ledgerlive-io[.]pages[.]dev

Analysis of desktop-ledgerlive-io.pages.dev shows that the domain was registered through Cloudflare, Inc. on 8 November 2025 and resolves to the Cloudflare edge address 172.66.47.63, which is announced by AS13335 in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain but offering no guarantee of legitimacy. HTTP probing returns a 403 status code and the page title returned by the server is “Suspected phishing site | Cloudflare”, matching the label used by Cloudflare’s block page. The site employs HSTS, HTTP/3 and other Cloudflare‑provided technologies, and its authoritative nameservers are riya.ns.cloudflare.com and roman.ns.cloudflare.com, confirming that the infrastructure is fully hosted on Cloudflare.

Reputation checks show that the domain appears on one known security blocklist and is listed by PhishDestroy as a confirmed malicious entry. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 14 positive detections out of 95 scanners, reflecting a consensus among multiple security vendors that the domain is associated with malicious activity. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, further corroborating its malicious nature. The listed scam type is “Crypto Scam” and the brand target is Ledger, indicating that the operator is attempting to impersonate the hardware‑wallet provider.

While the HTTP response is a generic block page and no payload has been observed, the combination of a recent registration date, Cloudflare‑only hosting, low trust scores, multiple vendor detections, and explicit brand impersonation provides strong evidence that the domain was used for credential harvesting or other fraudulent actions against Ledger users.