guide-ledgerdesk[.]pages[.]dev

guide-ledgerdesk.pages.dev was observed hosting a page titled “Ledger® Live: Desktop | Secure Crypto Management”, directly referencing the Ledger brand and indicating a crypto‑related impersonation campaign. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc., and the hosting infrastructure advertises HSTS, Cloudflare services, and HTTP/3 support. SSL is provided by Google Trust Services under the WE1 certificate, confirming a valid TLS certificate despite the malicious intent. VirusTotal records show that 10 of 94 scanning engines flagged the domain, providing independent confirmation of malicious behavior.

The site was registered through Cloudflare on 22 March 2026 and uses the nameservers christina.ns.cloudflare.com and sullivan.ns.cloudflare.com. Current HTTP response is 403, and the domain has been taken offline, but it was previously listed on at least one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, reinforcing the elevated risk classification.

The known intelligence does not include a full capture of the page content, form fields, or payloads, leaving the exact phishing mechanics uncertain. Defenders should immediately block the domain at DNS and proxy layers, add the IP address 188.114.96.3 to threat‑intel feeds, and monitor Cloudflare‑registered subdomains for similar brand‑impersonation patterns. Ongoing surveillance of the associated nameservers and rapid re‑registration checks are advised to detect potential re‑use of the same infrastructure.