lejger-live-dsktop[.]pages[.]dev

The domain lejger-live-dsktop.pages.dev was registered on April 11, 2026 and is hosted behind Cloudflare infrastructure (IP 172.66.44.145, CA location). The site presents a page titled "Ledger® Live: Desktop | Getting Started – Begin Secure Crypto Management Today", directly referencing the Ledger brand, and is classified as a brand impersonation campaign targeting Ledger users. The SSL certificate is issued by Google Trust Services / WE1, indicating a valid TLS connection, while the authoritative nameservers are javon.ns.cloudflare.com and rita.ns.cloudflare.com. The domain is currently active, returns HTTP 200, and has been flagged by PhishDestroy and appears on one security blocklist. Gridinsoft assigns a trust score of 0/100, reflecting a lack of confidence in the site. No detections have been reported by VirusTotal, but the absence of detections does not confirm safety. Investigation status is "under_investigation" and risk level remains pending further analysis. Defenders should treat the domain as a potential credential‑harvesting vector for Ledger users, enforce blocking at perimeter filters, monitor DNS queries for the domain, and consider adding it to internal blocklists. Continuous observation of any related phishing campaigns or malicious payloads associated with the IP address is recommended, as well as periodic re‑scanning with updated threat intelligence sources.