lader--live-desktop[.]pages[.]dev

This domain, lader--live-desktop.pages.dev, is currently under investigation for brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the domain was registered on April 24, 2026, through Cloudflare, Inc., and remains active as of July 12, 2026. The page title, 'Ledger Live Desktop — Secure Desktop App Guide,' explicitly references Ledger’s official software, reinforcing the likelihood of brand impersonation. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3, hosted on Cloudflare’s network in Canada, with nameservers alec.ns.cloudflare.com and teresa.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and the site employs HSTS, Cloudflare security layers, and HTTP/3, which are common in both legitimate and malicious deployments. No vendor detections were recorded in the most recent scan, though this does not confirm safety, as phishing domains often evade detection during early deployment. The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it for potential fraudulent activity. Gridinsoft’s trust score of 0/100 further suggests high-risk characteristics. While the exact content and functionality of the site remain unanalyzed, the combination of brand-specific page title, recent registration, and Cloudflare-hosted infrastructure aligns with known phishing tactics. Defenders should treat this domain as suspicious, monitor for further blocklist additions, and consider proactive blocking or sinkholing to mitigate potential user exposure. Additional forensic analysis, including payload inspection and behavioral monitoring, is recommended to determine the full scope of the threat.