lege-desktop-live[.]pages[.]dev

The domain lege-desktop-live.pages.dev was registered on March 28, 2026 through Cloudflare Pages and currently resolves to the Cloudflare IP address 172.66.44.159, which is geolocated to CA, United States. The site presents an HTTPS certificate issued by Google Trust Services (WE1) and returns HTTP status 200. The page title "Ledger® Live Desktop Download | Secure Hardware Wallet Management" explicitly references the Ledger brand, confirming the classification as a brand impersonation campaign targeting Ledger users. VirusTotal analysis shows that 7 of 94 security vendors flagged the domain, and the infrastructure has a Gridinsoft trust score of 0 out of 100. The domain is listed on at least one public blocklist and has been actively blocked by PhishDestroy. Current risk assessment is high, and the threat remains active. No additional content or payload details have been disclosed beyond the page title, leaving the exact phishing mechanics uncertain. Defenders should add lege-desktop-live.pages.dev to network and endpoint blocklists, monitor DNS queries for the associated IP, and enforce strict URL filtering for any Ledger-related download paths. Continuous re‑evaluation is advised as further intelligence, such as payload samples or victim reports, becomes available.