ledgerlive-desk-help[.]pages[.]dev

The domain ledgerlive-desk-help.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which is associated with Cloudflare’s network in Canada. The site presents a page title of “Ledger Live Desktop® | Secure Your Crypto Management,” explicitly referencing Ledger’s brand and indicating a crypto‑related impersonation attempt. The domain is classified as a crypto scam that impersonates Ledger, and it has been blocked by the PhishDestroy service. Infrastructure analysis shows the domain uses Cloudflare’s DNS (nameservers desi.ns.cloudflare.com and kellen.ns.cloudflare.com), HSTS, and HTTP/3, and serves an SSL certificate issued by Google Trust Services (WE1).

An HTTP request returns a 403 status, and the domain is currently taken offline. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. VirusTotal reports that 15 of 94 scanned security vendors flag the domain as malicious, reinforcing the threat assessment.

Although the site is no longer reachable, defenders should continue to block the domain at network perimeters and update any URL filtering policies to include it. Monitoring for newly registered domains that reference Ledger or use similar “ledgerlive” naming patterns is advised, as the attacker’s infrastructure (Cloudflare hosting and the same SSL provider) may be reused for future campaigns. The combination of brand‑specific page title, low trust score, multiple vendor detections, and blocklist inclusion provides a high confidence indicator of malicious activity targeting Ledger users.