ledger-liveedesktop[.]pages[.]dev

Analysis of ledger-liveedesktop.pages.dev shows an active high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered on March 30 2026 through Cloudflare, Inc., and resolves to the Cloudflare IP 172.66.47.185 located in Canada. DNS is served by cortney.ns.cloudflare.com and osmar.ns.cloudflare.com. The site presents a valid SSL certificate issued by Google Trust Services (WE1) and enforces HSTS, while employing Tailwind CSS, Cloudflare services, and HTTP/3. An HTTP 200 response confirms the page is reachable, and the page title "Ledger® Live Desktop: Getting Started with Secure Crypto Management" aligns with the declared Ledger brand impersonation. The domain is listed on one security blocklist and has been blocked by PhishDestroy. Reputation scoring is extremely low, with a Gridinsoft trust score of 0/100, and 7 of 94 VirusTotal scanners flag the domain. Defenders should immediately add the full domain and its resolving IP to outbound filtering rules, monitor for DNS queries to the associated Cloudflare nameservers, and ensure that any emails referencing Ledger Live Desktop URLs are quarantined. Continuous threat‑intel feeds should be consulted for potential related indicators, and users should be warned not to interact with the site or provide credentials.