desk-ledjelive[.]pages[.]dev

Analysis indicates that desk-ledjelive.pages.dev is an active brand impersonation domain targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on March 30, 2026, and currently resolves to IP address 188.114.96.3, hosted through Cloudflare infrastructure. The page title, 'Official Ledger Live Desktop App | Safe Wallet for Crypto Investors,' explicitly claims affiliation with Ledger Live, Ledger's official desktop application, suggesting an intent to deceive users into believing the site is legitimate. Technical indicators support the classification of this domain as malicious. The domain is flagged by 9 of 95 security vendors in a recent scan, and it appears on at least one security blocklist, including PhishDestroy. The domain has a trust score of 0/100, further corroborating its high-risk status. SSL certification is provided by Google Trust Services, which does not inherently validate the site's legitimacy but ensures encrypted connections, a common tactic used by threat actors to appear trustworthy. Infrastructure analysis reveals the use of Cloudflare services, including HSTS and HTTP/3, which may be leveraged to obscure the true origin of the domain and evade detection. The domain's creation date, while recent, is not anomalous for phishing campaigns, which often employ short-lived domains to avoid long-term scrutiny. Defenders should treat this domain as a confirmed phishing resource. Immediate action is recommended, including blocking the domain at the DNS or proxy level, updating endpoint protection rules to flag or quarantine connections to this address, and alerting users to the presence of this impersonation campaign. The exact content and functionality of the site remain unanalyzed, but the available evidence strongly suggests it is designed to harvest credentials or distribute malicious software under the guise of a legitimate cryptocurrency wallet application.