ledger-livedesktop-learn[.]pages[.]dev

Analysis of the domain ledger-livedesktop-learn.pages.dev, registered on March 28, 2026, indicates targeted brand impersonation of Ledger, a cryptocurrency hardware wallet provider. The domain is hosted on Cloudflare infrastructure, resolving to IP address 172.66.47.128, and uses Cloudflare nameservers benedict.ns.cloudflare.com and maxine.ns.cloudflare.com. As of July 29, 2026, ten out of ninety-one security vendors on VirusTotal have flagged this domain as malicious, and it appears on one security blocklist, specifically PhishDestroy. No additional details regarding the website's content, such as page title or specific phishing kit, are currently available in the intelligence feed.

The domain's creation date, four months prior to this report, suggests it may have been established for short-term malicious use, a common tactic in phishing operations targeting financial or cryptocurrency brands. The use of Cloudflare hosting is consistent with adversaries attempting to obscure origin infrastructure and evade detection. While the exact nature of the phishing content remains unconfirmed, the domain's naming convention—incorporating 'ledger' and 'live desktop'—strongly implies an attempt to deceive users into believing it is an official Ledger software portal. Defenders are advised to block the domain and its resolving IP at the network perimeter.

Security teams should monitor for connections to 172.66.47.128 or DNS queries to ledger-livedesktop-learn.pages.dev, particularly from endpoints associated with cryptocurrency activity. If internal logs confirm user access, initiate credential reset procedures and review associated accounts for unauthorized transactions. No evidence currently links this domain to a broader campaign, but correlation with other Ledger-themed phishing domains may reveal additional infrastructure.