ldgr-live-destop-faq-cav[.]pages[.]dev

Analysis indicates that the domain ldgr-live-destop-faq-cav.pages.dev was registered on March 22 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge IP 172.66.47.147, which is geolocated to Canada and is associated with the Cloudflare network. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that the site used a legitimate certificate chain. HTTP response code 403 was returned when the URL was accessed, suggesting the site is presently inaccessible; its status is listed as offline. The page title retrieved from the site reads “Ledger® Live: Desktop — Getting Started withDevicer”, explicitly referencing Ledger’s brand name and indicating an attempt to impersonate Ledger’s official Live desktop application. The brand target is identified as Ledger, and the overall scam classification is a crypto‑related scam.

Detection telemetry shows that 15 of 94 security vendors on VirusTotal flagged the domain as malicious, and the site appears on a single security blocklist. It has been blocked by the PhishDestroy feed. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. The nameservers listed are kallie.ns.cloudflare.com and neil.ns.cloudflare.com, typical of Cloudflare‑hosted domains. Observed technologies include HTTP/3, HSTS, and the Cloudflare CDN, all of which are consistent with the hosting environment but do not mitigate the phishing risk.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as the site content has not been captured and the HTTP 403 response prevents content analysis. No further indicators such as URLs, email templates, or malicious binaries have been disclosed. Defenders should add ldgr-live-destop-faq-cav.pages.dev to URL blocklists, monitor for any resolution to non‑Cloudflare IPs, and enforce endpoint protection that flags connections to this domain.