en-x-dekstop-ledger[.]pages[.]dev

The domain en-x-dekstop-ledger.pages.dev was registered on 2026-04-18 through Cloudflare, Inc. It resolves to the Cloudflare edge address 172.66.44.254 located in Canada and is served by the Cloudflare nameservers jocelyn.ns.cloudflare.com and matt.ns.cloudflare.com. The site presents a valid SSL certificate issued by Google Trust Services (WE1) and enforces HTTP Strict Transport Security and HTTP/3, indicating a modern web stack. The page title returned by the HTTP 200 response is "Ledger® Live Desktop® | Secure Crypto® Management," directly referencing the Ledger brand and confirming a brand‑impersonation intent. Threat intelligence flags the domain as a high‑risk, active brand‑impersonation campaign targeting Ledger users. It is currently listed on one security blocklist, has been blocked by PhishDestroy, and received detections from 9 of 94 VirusTotal scanners. The Gridinsoft trust score of 0/100 reinforces the malicious assessment. No additional payload or credential‑harvesting details are available from the provided data. Defenders should immediately block the domain at network perimeter and DNS layers, add the associated IP to threat‑intel feeds, and monitor for any related Cloudflare‑hosted subdomains that may be leveraged for similar impersonation attempts. Continuous re‑scanning is advised to detect any future changes in payload or hosting configuration.