ldzer-live-desktop-page[.]pages[.]dev

The domain ldzer-live-desktop-page.pages.dev was identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Ledger Live platform, likely for fraudulent crypto asset extraction or credential harvesting. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered on March 25, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.47.25. It was flagged by 9 of 95 security vendors on VirusTotal, indicating broad detection of its malicious nature. The domain appeared on one security blocklist (PhishDestroy) and held a Gridinsoft trust score of 0/100. Technical indicators include the use of HSTS, Cloudflare hosting, and HTTP/3, alongside an SSL certificate issued by Google Trust Services. The page title, 'Ledger Live: Secure Crypto Management Platform,' directly mirrors the branding of the legitimate Ledger service. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Organizations and individuals are advised to block the domain and associated IP (172.66.47.25) at the network level. Users who accessed the site should assume potential exposure of wallet credentials or sensitive data and take immediate remedial action, including revoking access to any linked crypto wallets, rotating passwords, and monitoring for unauthorized transactions. Security teams should review logs for connections to the domain or IP and correlate with anomalous crypto-related activity.