safe-desktop-live[.]pages[.]dev

The domain safe-desktop-live.pages.dev was registered on April 18, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s edge network, resolving to IP address 188.114.96.3, which is attributed to Cloudflare, Inc. in Canada. The authoritative nameservers are jessica.ns.cloudflare.com and mitch.ns.cloudflare.com. An HTTPS connection is presented using a Google Trust Services / WE1 certificate, and the site enforces HSTS and supports HTTP/3, indicating a modern server configuration. The page title returned by the HTTP 200 response is "Ledger® Live: | Getting started with Ledger," explicitly targeting the Ledger brand. The threat type is classified as brand impersonation, and the risk level is high. The domain is currently active and has been blocked by PhishDestroy; it appears on one security blocklist. VirusTotal analysis shows that 10 of 94 security vendors flagged the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100. While the infrastructure details are clear, the content of the page beyond the title has not been publicly disclosed, leaving the exact credential‑capture mechanism uncertain. Defenders should block the domain at network perimeter, update URL filtering lists with the observed indicator set, and monitor for any related subdomains or similar Cloudflare‑hosted assets that reference Ledger. Continuous threat‑intel feeds should be consulted for any emerging variants that reuse the same registrar or IP range.