ledgerlive-desktop--info[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware wallet provider. The site mimics the official Ledger Live Desktop interface, likely designed to deceive users into disclosing cryptocurrency wallet credentials or executing unauthorized transactions. Analysis indicates the infrastructure is engineered to exploit trust in the Ledger brand, a common tactic in crypto asset fraud schemes. Infrastructure analysis reveals the domain ledgerlive-desktop--info.pages.dev was registered through Cloudflare, Inc. on April 22, 2026, and resolves to the IP address 172.66.47.52, geolocated to Canada under Cloudflare’s network. The domain is currently active and appears on one security blocklist. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused to lend credibility to fraudulent sites. The page title, 'Ledger Live Desktop: Getting Started with Crypto Asset Management,' closely mirrors legitimate Ledger documentation, increasing the likelihood of successful social engineering. Mitigation requires immediate action from security teams and end users. Network-level blocking of 172.66.47.52 and the domain is recommended to prevent access. Users should verify the authenticity of Ledger-related communications by cross-referencing official channels and avoiding links from unsolicited messages. Cryptocurrency holders are advised to enable hardware wallet security features, such as transaction confirmation on the device itself, to mitigate credential theft or unauthorized transfers. Organizations should monitor for similar domains leveraging Cloudflare Pages infrastructure, as this hosting service is frequently exploited for low-cost, high-impact phishing campaigns.