ledger-livv-deskktop[.]pages[.]dev

The domain ledger-livv-deskktop.pages.dev was registered through Cloudflare on 23 Mar 2026 and resolves to the Cloudflare edge address 172.66.46.230, which is geolocated to Canada. Authoritative nameservers are carlos.ns.cloudflare.com and ines.ns.cloudflare.com, confirming Cloudflare’s control of the zone. The site presented the page title "Ledger Live Desktop - Secure Crypto Management App | Ledger", an exact match to Ledger’s official product title, indicating a deliberate brand‑impersonation attempt aimed at Ledger users. TLS termination is performed by Google Trust Services (certificate chain labelled WE1), and the server advertises HSTS, HTTP/3 and other Cloudflare security headers, showing that the attacker leveraged Cloudflare’s free hosting to obtain a valid certificate.

HTTP responses currently return 403 and the site has been taken offline, yet it remains listed on at least one public blocklist and was blocked by PhishDestroy. Reputation scoring is extremely low, with Gridinsoft assigning 0 / 100. VirusTotal analysis shows 15 of 94 scanning engines flag the domain as malicious, corroborating the classification as a crypto‑related scam.

The intelligence confirms the domain impersonates Ledger and is categorized as a crypto scam, but no landing‑page screenshots, credential‑harvesting forms, or malware samples have been captured, leaving the exact payload unknown. Defenders should block the IP 172.66.46.230 and the full domain in DNS filtering and firewall rules, add the domain to internal threat‑intel feeds, and share the indicator set (domain, IP, SSL fingerprint) with relevant ISACs. Continuous monitoring of the pages.dev namespace is advised, as the same infrastructure could be reused for future Ledger‑targeted campaigns.