ledgrg[.]pages[.]dev

This domain, ledgrg.pages.dev, was registered on 30 April 2026 and is currently resolved to the Cloudflare‑owned address 188.114.97.3 located in Canada. The site presents a TLS certificate issued by Google Trust Services under the WE1 program, and the server advertises HSTS and HTTP/3, indicating a modern web stack. The page title “Ledger® Desktop | Secure Crypto Management” aligns with the declared brand target Ledger, confirming a brand‑impersonation intent. The domain appears on one public blocklist (PhishDestroy) and has been flagged by six of ninety‑one VirusTotal scanners, reinforcing its malicious classification. Infrastructure analysis shows the domain is hosted behind Cloudflare’s DNS (itzel.ns.cloudflare.com, yoxall.ns.cloudflare.com), which can obscure the true origin of any payload. At present the site returns HTTP 200, suggesting an active web service. Defenders should immediately block DNS resolution and HTTP traffic to ledgrg.pages.dev, incorporate the IP 188.114.97.3 into network‑level deny lists, and monitor for any outbound connections to Cloudflare edge nodes that may be used for content delivery. Threat intelligence feeds should be updated to reflect the high‑risk, active status, and security teams should watch for similar Ledger‑related impersonation attempts that reuse the same certificate issuer or page title pattern.