desktop-ledger-app-en[.]pages[.]dev

Analysis of desktop-ledger-app-en.pages.dev shows a clear association with a crypto‑draining campaign. The domain is registered through Cloudflare, Inc. and uses Cloudflare‑managed nameservers (benedict.ns.cloudflare.com and maxine.ns.cloudflare.com), indicating that the attacker leveraged Cloudflare’s DNS and CDN services to hide the true origin of the content. DNS resolution points to IP address 172.66.47.46, an address owned by Cloudflare, which further obscures attribution and complicates takedown efforts.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, demonstrating that at least one anti‑phishing organization has classified it as malicious. VirusTotal has recorded eight detections out of ninety‑one scanners, confirming that multiple independent security products have flagged the domain as suspicious or malicious. No additional intelligence such as Safe Browsing status, OTX tags, SSL certificate details, HTTP response codes, or page title information is available, so the exact content served by the site cannot be described at this time.

The limited visibility suggests that the operator may be employing fast‑flux or temporary hosting tactics, relying on Cloudflare’s infrastructure to reduce detection latency. Defenders should add desktop-ledger-app-en.pages.dev to DNS and URL filtering policies, monitor for outbound connections to 172.66.47.46, and consider broader blocks of the parent pages.dev namespace if similar patterns emerge. Continuous re‑scanning with VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection ratios, and threat‑intel feeds should be updated to reflect the domain’s active status as of July 29, 2026.