desktop-ledgr-live-en[.]pages[.]dev

This domain, desktop-ledgr-live-en.pages.dev, is flagged as a generic phishing site specializing in cryptocurrency wallet credential harvesting. Analysis indicates the infrastructure mimics legitimate blockchain interfaces to deceive users into disclosing private keys or seed phrases. No specific brand impersonation or known drainer kit signatures were identified in initial triage, though the domain naming convention suggests targeting of decentralized finance platforms. Infrastructure analysis reveals the following technical indicators: the domain was registered through Cloudflare, Inc. on April 4, 2026, with an anomalous future creation date suggesting potential timestamp manipulation. It resolves to IP address 172.66.44.163, a Cloudflare edge node commonly used for both legitimate and malicious content distribution. Detection metrics show 7 out of 95 security vendors flagging the domain on VirusTotal, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services, providing HTTPS encryption that may lend false legitimacy to the phishing attempt. Google Safe Browsing status was not explicitly provided in available data. Current status indicates the domain has been taken offline, likely following detection and reporting. The page title 'Suspected phishing site | Cloudflare' suggests Cloudflare's automated systems or manual review identified and mitigated the threat. Despite the takedown, residual risk remains as threat actors may re-deploy similar infrastructure under different subdomains or domains. Users are advised to verify all blockchain transaction interfaces through official sources, enable hardware-based two-factor authentication for wallet access, and cross-reference domain registration dates with expected service launch timelines. The anomalous 2026 creation date serves as a critical red flag for similar threats.