ledger-live-deskto[.]pages[.]dev

This report details a suspected phishing threat targeting the cryptocurrency sector. The domain ledger-live-deskto.pages.dev displayed a page title of "Suspected phishing site | Cloudflare," indicating it was blocked as a phishing attempt. The site impersonated the brand Ledger, a cryptocurrency hardware wallet provider, and was classified as a cryptocurrency scam. The primary threat posed by this site was credential theft and cryptocurrency asset compromise, as it likely aimed to trick users into revealing sensitive information such as wallet recovery phrases or login credentials.

Technical analysis provides clear evidence of malicious intent. VirusTotal recorded 6 detections out of 95 vendors, with flags from Criminal IP, alphaMountain.ai, CyRadar, Fortinet, and Kaspersky. The domain was registered on 2025-09-10 via Cloudflare, Inc. and hosted on IP address 172.66.47.173 (United States, AS13335 Cloudflare, Inc.). The SSL certificate was issued by Google Trust Services / WE1. Nameservers were david.ns.cloudflare.com and sharon.ns.cloudflare.com. The domain was listed on 1 blocklist.

The site is currently offline or down. Risk assessment tools indicate a very high threat level: GridinSoft trust rating is 0 out of 100, ScamAdviser trust rating is 1 out of 100, and the DOM risk score is 83. Based on the brand impersonation, detection by multiple security vendors, and extremely low trust scores, this domain represents a critical risk to cryptocurrency users.