us-eng-desktop-ledger[.]pages[.]dev

This domain, us-eng-desktop-ledger.pages.dev, is an active brand impersonation site targeting Ledger, a cryptocurrency hardware wallet provider. Registered on March 30, 2026, through Cloudflare, the domain resolves to IP 188.114.96.3 and is hosted on Cloudflare infrastructure, utilizing HSTS and HTTP/3 protocols. The page title, 'Ledger Live Desktop – Secure Crypto Portfolio Manager,' directly mimics Ledger’s official software, suggesting intent to deceive users into downloading malicious software or entering credentials. As of July 12, 2026, the domain remains active and appears on at least one security blocklist, with 12 of 95 security vendors flagging it in VirusTotal scans. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to the prevalence of SSL in phishing campaigns. Defenders should treat this domain as high-risk, block it at the network level, and monitor for related indicators of compromise, such as connections to the resolving IP or associated Cloudflare infrastructure. The exact payload or attack chain remains unconfirmed, but the domain’s branding and page title align with known tactics used in cryptocurrency-related phishing. Further analysis of the site’s content or payload is recommended to determine specific malicious behaviors.