desktop-ledgrelives[.]pages[.]dev

The domain desktop-ledgrelives.pages.dev was registered on March 24, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. DNS resolution uses the Cloudflare authoritative nameservers khloe.ns.cloudflare.com and michael.ns.cloudflare.com. The site presented a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating the use of Cloudflare’s SSL termination service. HTTP requests return a 403 status code, suggesting the content is no longer publicly accessible; the current status is reported as offline.

The page title observed during the brief analysis was "Ledger Live Desktop | Complete Guide to Secure Crypto Management," and the campaign is classified as brand impersonation targeting the Ledger brand. Technical fingerprinting identified the presence of HTTP/3, HSTS enforcement, and the Cloudflare platform, confirming the use of modern web infrastructure. VirusTotal scans recorded four detections out of ninety‑four security vendors, and the domain appears on a single external blocklist. PhishDestroy has also blocked the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent.

The limited detection footprint—four vendor flags, one blocklist entry, and a zero trust score—suggests that the malicious infrastructure was short‑lived or quickly mitigated. Defenders should add the domain and its associated IP address to firewall and DNS filtering rules, monitor for any resurgence of similar subdomains under the pages.dev namespace, and continue to observe Cloudflare‑issued certificates for newly registered Ledger‑related domains. Because the site is currently offline, no further content analysis is possible, and the exact payload or credential‑harvesting mechanisms remain unknown. Ongoing vigilance is recommended to detect any re‑activation or reuse of the identified infrastructure.