live-ledgr-desk[.]pages[.]dev

This domain, live-ledgr-desk.pages.dev, is actively impersonating Ledger, a hardware wallet provider, as indicated by its page title 'Ledger Live Desktop — Secure Crypto Management | Official Hardware Wallet Interface' and confirmed brand target classification. Registered on April 4, 2026, through Cloudflare, Inc., the domain resolves to IP 188.114.97.3, hosted in Canada under Cloudflare’s infrastructure. Analysis reveals a Gridinsoft trust score of 0/100, and the domain appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted pages. Eight of 94 security vendors on VirusTotal flag this domain as malicious, though the specific detection rules or payloads are not detailed in available intelligence. The HTTP status returns 200, confirming the page is accessible. Nameservers adel.ns.cloudflare.com and randy.ns.cloudflare.com further link the domain to Cloudflare’s network, a frequent choice for threat actors due to its free hosting and privacy features. While the domain’s exact content remains unanalyzed, its branding, page title, and classification as a brand impersonation site align with known tactics targeting cryptocurrency users. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring access. No evidence suggests the use of a phishing kit or additional payloads, but the domain’s active status and impersonation of a cryptocurrency security product warrant immediate mitigation.