ledger-desktop-app-live[.]pages[.]dev

This domain ledger-desktop-app-live.pages.dev was registered on February 21, 2026 and is hosted on Cloudflare infrastructure (ASN 13335, United States). DNS resolution points to IP 188.114.96.3 and the authoritative name servers are liv.ns.cloudflare.com and ian.ns.cloudflare.com. The site presents an HTTPS endpoint with a Google Trust Services / WE1 certificate and supports HSTS and HTTP/3, indicating a modern TLS configuration. The page title observed in the snapshot reads "Ledger Live Desktop | Complete Guide to Secure Crypto 🚀", which aligns with a wallet/seed phishing campaign targeting Ethereum users. The domain is listed on a single security blocklist and has been flagged by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows one of ninety‑three scanners marking the domain as malicious, reinforcing the risk profile. An HTTP 403 response is returned, and the site is currently taken offline, which limits immediate interaction but does not remove the threat of reuse of the same infrastructure. Defenders should block the domain at perimeter firewalls, update URL filtering feeds with the observed indicator, and monitor for any re‑registration of the same host name or similar sub‑domains.

Because the site leverages Cloudflare’s CDN, threat actors can quickly redeploy a replica, so continuous DNS and SSL certificate monitoring is recommended. Incident response teams should also consider correlating internal logs for any connections to 188.114.96.3 or attempts to access ledger‑desktop‑app‑live.pages.dev, especially from endpoints handling Ethereum wallets or seed phrases. The limited detection footprint (single blocklist entry and one positive vendor) suggests that broader intelligence sharing may be needed to increase coverage. Until the domain is confirmed permanently removed, it remains an elevated‑risk indicator for credential harvesting against Ethereum users.