ledger-live-desktop-auth[.]pages[.]dev

On 24 July 2026, the domain ledger-live-desktop-auth.pages.dev was identified as a brand‑impersonation infrastructure targeting Ledger users. The site was hosted on Cloudflare’s network and resolved to 172.66.44.147, an IP geolocated to Canada and owned by Cloudflare, Inc. DNS resolution used the Cloudflare authoritative name servers austin.ns.cloudflare.com and marissa.ns.cloudflare.com. The TLS certificate presented by the host was issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration that enforced HSTS and leveraged HTTP/3. An HTTP GET returned a 403 status code, suggesting that the page was inaccessible at the time of analysis; the domain has since been taken offline, and the current status is recorded as offline.

The page title retrieved before takedown read “Ledger Live Desktop - Secure Crypto Management App,” directly referencing the Ledger brand and confirming the impersonation intent. The domain was created on 22 March 2026 and registered through Cloudflare, Inc., a common registrar for malicious actors who exploit its rapid provisioning capabilities. Reputation checks show a Gridinsoft trust score of 0 / 100 and a VirusTotal detection ratio of 14 / 94 scanners flagging the domain, reflecting a moderate level of malicious confidence among security vendors. The domain appears on one public blocklist and is listed as blocked by the PhishDestroy service.

The observed scam type is classified as a “Crypto Scam,” aligning with Ledger’s focus on cryptocurrency management. While the infrastructure details are concrete, the exact phishing payload, credential‑harvesting mechanisms, and any associated command‑and‑control endpoints remain unknown because the site was not captured prior to takedown. Defenders should continue to monitor Cloudflare‑hosted domains that resolve to the same IP range, enforce blocklist entries for ledger-live-desktop-auth.pages.