desh-en-ledger-live[.]pages[.]dev

Analysis of desh-en-ledger-live.pages.dev indicates a phishing domain targeting Ethereum users through brand impersonation of Ledger Live, a cryptocurrency wallet management platform. The domain, registered on February 21, 2026, was hosted on Cloudflare infrastructure (AS13335) and resolved to IP 188.114.97.3, located in the United States. The page title, 'Ledger® Live: Desktop | Getting Started Guide,' directly mimics official Ledger documentation, suggesting an intent to deceive users into disclosing wallet credentials or seed phrases. As of July 24, 2026, the domain is offline, returning an HTTP 403 status, though it remains listed on at least one security blocklist (PhishDestroy) and was flagged by 11 of 93 security vendors on VirusTotal prior to takedown.

Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and employed Cloudflare nameservers (magali.ns.cloudflare.com, anuj.ns.cloudflare.com). The SSL certificate, issued by Cloudflare TLS Issuing ECC CA 3 (SSL Corporation), does not provide independent validation of legitimacy. Trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further indicate malicious classification. The domain's creation date and use of Cloudflare's hosting align with common phishing tactics to evade detection while maintaining low operational costs.

While the exact content of the phishing page is not analyzed, the combination of the page title, scam type (wallet/seed phishing), and brand target (Ethereum) strongly suggests a campaign designed to harvest cryptocurrency wallet recovery phrases. Defenders should treat this domain as part of a broader pattern of Ledger Live impersonation and prioritize blocking it at the DNS or proxy level. Monitoring for re-registration or similar domains (e.g., ledger-live.pages.dev variants) is recommended, as phishing actors frequently reuse infrastructure. No evidence links this domain to other known threat groups or broader campaigns at this time.