public-desktop-ledgr[.]pages[.]dev

The domain public-desktop-ledgr.pages.dev was registered on 24 March 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.47.191 located in Canada. Registration data lists Cloudflare, Inc. as the registrar and the authoritative nameservers celeste.ns.cloudflare.com and ernest.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s free hosting service to obtain a trusted TLS certificate from Google Trust Services (WE1). The site served HTTP status 403 and advertised the page title “Ledger Live Desktop —— Secure Crypto Management App || Ledger”, which directly references the Ledger brand and aligns with the reported crypto‑scam classification. Infrastructure analysis shows the presence of HSTS and HTTP/3, typical of Cloudflare‑enabled sites, and the domain appears on a single security blocklist.

Gridinsoft assigned a trust score of 0 / 100, and PhishDestroy has already blocked the domain. VirusTotal recorded a single positive detection out of ninety‑four scanning engines, confirming that at least one vendor flagged the domain as malicious. No additional public intelligence such as OTX tags, Safe Browsing alerts, or broader blocklist listings were observed. Defenders should add 172.66.47.191 to network‑level deny lists and enforce DNS filtering for the full public‑desktop‑ledgr.pages.dev subdomain.

Because the domain uses a legitimate Cloudflare certificate, static certificate pinning may be ineffective; instead, rely on domain reputation and the observed page title to trigger alerts. Continuous monitoring of newly created *.pages.dev subdomains that contain “ledger” or similar brand terms is recommended, as the same infrastructure could be reused for future impersonation attempts. The current offline status suggests the operator has taken the site down, but the underlying hosting configuration remains reusable, so proactive blocking is advisable.