ledger-homepages[.]pages[.]dev

Analysis of ledger-homepages.pages.dev shows a newly registered domain (created 29 April 2026) that hosts a page titled "Ledger Live Desktop - Securely Manage Your Crypto Assets" and explicitly targets the Ledger brand. The site is served through Cloudflare, Inc., resolving to IP address 188.114.97.3 located in Canada, and presents a valid SSL certificate issued by Google Trust Services under the WE1 hierarchy, indicating encrypted HTTPS traffic with HSTS and HTTP/3 enabled. Infrastructure data reveal the domain is registered via Cloudflare nameservers (cruz.ns.cloudflare.com, yichun.ns.cloudflare.com) and currently returns HTTP 200. Security telemetry indicates the domain is listed on the PhishDestroy blocklist and has been flagged by 10 of 91 VirusTotal scanners; Gridinsoft reports a trust score of 0/100, underscoring a high likelihood of malicious intent. While the page content beyond the title has not been publicly dissected, the combination of brand‑specific title, recent registration, use of reputable hosting services to mask origin, and multiple security vendor detections aligns with a high‑risk brand impersonation campaign. Defenders should block the domain at network and endpoint layers, monitor DNS queries for the associated IP and nameservers, and update threat intelligence feeds to include this indicator. Ongoing observation is recommended to detect any evolution of the site’s payload or credential‑ harvesting mechanisms.