ledger-dekstop-hub[.]pages[.]dev

This domain, ledger-dekstop-hub.pages.dev, was registered on 11 April 2026 via Cloudflare’s registrar service and is currently hosted behind Cloudflare’s network (IP 172.66.44.238, located in Canada). The site presents a valid SSL certificate issued by Google Trust Services (WE1) and supports HSTS and HTTP/3, indicating a modern web stack. An HTTP 200 response is returned for the root URL, and the page title observed is “Ledger Live Desktop | Secure & Stylish Crypto Management,” directly referencing the Ledger brand. Security telemetry shows that nine of ninety‑four scanners on VirusTotal flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one public blocklist and is already listed by PhishDestroy as blocked. The infrastructure aligns with a brand‑impersonation campaign targeting Ledger users, consistent with the reported scam type. No additional content analysis is available beyond the title, so the exact malicious payload (e.g., credential‑stealing form or download) remains unknown. Defenders should add the domain and its associated IP address to web‑filter deny lists, monitor DNS queries for the domain and its Cloudflare nameservers (celine.ns.cloudflare.com, damian.ns.cloudflare.com), and enforce TLS inspection to detect any anomalous traffic. Continuous threat‑intel feeds should be consulted for updates, and any credential‑theft attempts related to Ledger accounts should be investigated promptly.