guide-desktop-en-ledger[.]pages[.]dev

This domain, guide-desktop-en-ledger.pages.dev, is flagged as an active high-risk phishing site impersonating Ledger, a hardware wallet provider. Registered on April 30, 2026, through Cloudflare, the domain resolves to IP 172.66.44.242 and presents a page titled 'Ledger® Live: Desktop — Getting Started,' directly mimicking the official Ledger Live desktop application. Infrastructure analysis reveals the use of Cloudflare hosting, HTTP/3, and HSTS, alongside an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to potential victims. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Ten of 95 security vendors on VirusTotal have flagged this domain as malicious, though the absence of detections from other vendors does not confirm safety. The exact content and functionality of the site remain unanalyzed, but the page title and brand impersonation strongly suggest an attempt to harvest credentials or distribute malicious software under the guise of a legitimate Ledger product. Defenders should treat this domain as compromised and prioritize blocking or monitoring traffic to it. Further investigation into associated infrastructure, such as the hosting IP and SSL certificate, may reveal additional linked phishing domains.