desktop-ledgr-co[.]pages[.]dev

The domain desktop-ledgr-co.pages.dev was registered on March 30, 2026 through Cloudflare, Inc. It resolves to the Cloudflare edge IP 188.114.97.3 located in Canada. The site presents a login page titled “Ledger Desktop Sign In | Secure Crypto Wallet Portal,” explicitly mimicking Ledger’s official branding. The page is served over HTTPS with a certificate issued by Google Trust Services (WE1) and enforces HSTS, indicating a legitimate TLS configuration despite malicious intent. Infrastructure analysis shows the domain is hosted on Cloudflare’s global network, leveraging HTTP/3 and standard Cloudflare nameservers (joel.ns.cloudflare.com, sima.ns.cloudflare.com). The use of Cloudflare’s CDN masks the origin server, a common tactic for phishing sites to evade takedown and to benefit from Cloudflare’s performance and security features. The HTTP response code is 200, confirming the page is actively serving content. Threat intelligence flags this domain as a credential‑phishing operation targeting Ledger users. It appears on one security blocklist and is listed by PhishDestroy as an active malicious site. The Gridinsoft trust score is 0/100, and VirusTotal reports four detections out of ninety‑five scanners, reinforcing the malicious classification. The page’s title and visual cues are designed to harvest Ledger desktop wallet credentials, aligning with the known “brand impersonation” scam type. Defenders should block the domain at the DNS and proxy layers, add it to endpoint allow‑list exclusions, and monitor for any outbound connections to the resolving IP 188.114.97.3. Email filters must be updated to flag messages containing the domain or its variations. Incident response teams should educate users about the fraudulent Ledger login page and advise verification of URLs against official Ledger domains. Continuous monitoring of Cloudflare‑hosted domains for similar impersonation patterns is recommended.