ledjer-live-desktop-en[.]pages[.]dev

Analysis of ledjer-live-desktop-en.pages.dev shows a newly registered domain created on March 24, 2026 that was used to host a page titled "Ledger Live Wallet Setup – Official Desktop". The page title explicitly references Ledger, matching the declared brand target of Ledger and the listed scam type of a crypto scam. The domain resolves to IP address 188.114.96.3, which belongs to Cloudflare, Inc. and is geolocated to Canada. DNS resolution uses the Cloudflare nameservers kirk.ns.cloudflare.com and mary.ns.cloudflare.com, indicating the infrastructure is fully provisioned through Cloudflare’s edge network.

HTTPS is served with a certificate issued by Google Trust Services under the WE1 identifier, and the site enforces HSTS while supporting HTTP/3, confirming modern TLS configuration. When accessed, the server returned HTTP status code 403, suggesting the content is no longer publicly reachable; the current status is recorded as offline. Reputation signals are uniformly negative: Gridinsoft assigned a trust score of 0 out of 100, the domain appears on one known security blocklist, and PhishDestroy has flagged it as blocked. VirusTotal scans reported three detections out of ninety‑four scanners, reinforcing the malicious classification.

The elevated risk rating aligns with the observed brand impersonation and crypto‑focused lure. While the content itself has not been captured, the combination of brand‑targeted page title, crypto‑scam labeling, low trust score, blocklist presence, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host, and advise users, especially Ledger customers, to disregard any unsolicited requests to install or configure Ledger Live from this URL. Ongoing telemetry should be collected to confirm that the offline status persists and to detect any potential re‑hosting on alternative infrastructure.