ledger-livedeskktp[.]pages[.]dev

On 25 July 2026, analysis identified the domain ledger-livedeskktp.pages.dev as part of an elevated‑risk brand impersonation campaign targeting Ledger. The site was registered through Cloudflare, Inc. on 13 April 2026 and resolves to the Cloudflare IP address 172.66.44.123, which is geolocated to Canada. DNS resolution uses the Cloudflare nameservers david.ns.cloudflare.com and indie.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS certificate despite the malicious purpose. An HTTP request to the host returns a 403 status code, indicating that the page is currently inaccessible; the domain status is reported as offline and the site has been blocked by the PhishDestroy platform and appears on a single security blocklist.

The page title presented by the server reads “Ledger Live Desktop — Secure Crypto Management: Trust, Resilience, and Future‑Proofing”, directly referencing Ledger’s product line and reinforcing the impersonation intent. Technology fingerprinting reveals the presence of Tailwind CSS, HTTP Strict Transport Security (HSTS), Cloudflare’s edge services, and HTTP/3 support. Reputation scoring from Gridinsoft assigned a 0 / 100 trust rating. VirusTotal scans show that 8 of 94 antivirus engines flagged the domain as malicious, providing independent confirmation of its abusive nature.

Given the combination of a brand‑specific page title, verified SSL issuance, and multiple vendor detections, defenders should treat ledger‑livedeskktp.pages.dev as a confirmed malicious resource. Recommendations include adding the domain and its resolved IP address to DNS‑based deny lists, updating web‑filter signatures, and monitoring for any re‑registration or re‑activation. Continuous observation of Cloudflare‑issued IP ranges for similar impersonation attempts is advised, as the infrastructure can be rapidly repurposed.