ledg-er-live-desktop-cloud[.]pages[.]dev

The domain ledg-er-live-desktop-cloud.pages.dev was created on March 24, 2026 and is hosted on Cloudflare infrastructure, resolving to IP address 172.66.47.164, which is geolocated to Canada and listed as a Cloudflare, Inc. range. The domain registration also shows Cloudflare, Inc. as the registrar, and the authoritative name servers are archer.ns.cloudflare.com and hadlee.ns.cloudflare.com. An HTTPS connection presents a Google Trust Services / WE1 certificate, and the site advertises HSTS and HTTP/3 support. When accessed, the server returns HTTP 403, indicating that the resource is currently inaccessible; the domain has been taken offline according to the latest intelligence.

The page title returned by the server is "Ledger Live Desktop — Install, Features, Security," directly referencing Ledger’s official product line, confirming a brand‑impersonation intent. VirusTotal analysis shows that 11 of 94 security scanners flagged the domain, and it appears on a single public blocklist, specifically PhishDestroy, which categorises the threat as a crypto scam. Independent rating from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The evidence set therefore points to a credential‑harvesting or crypto‑focused campaign that mimics Ledger’s legitimate branding to lure victims. Defenders should add the domain and its resolving IP to network deny lists, enforce DNS filtering for Cloudflare‑registered domains that claim Ledger affiliation, and monitor for newly‑registered domains with similar naming patterns. Continuous re‑scanning of the domain is advisable in case it resurfaces, and any detection of outbound connections to the listed IP should be investigated as potential compromise attempts.