ledger--dapp[.]pages[.]dev

The domain ledger--dapp.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.161, which belongs to AS13335 Cloudflare, Inc. in the United States. The site returns an HTTP 403 status and the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare has removed the content. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid certificate chain but offering no assurance of legitimacy. Reputation services assign a Scamadviser trust score of 10 / 100 and a Gridinsoft score of 0 / 100, both suggesting a high probability of malicious intent.

The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed. VirusTotal analysis recorded seven detections out of ninety‑three scanning engines, reflecting modest community detection. Infrastructure analysis shows Cloudflare‑provided services, including HSTS, HTTP/3, and the nameservers daisy.ns.cloudflare.com and tony.ns.cloudflare.com, a configuration frequently leveraged by both legitimate and abusive actors. The campaign is classified as a crypto scam that impersonates the Ledger brand.

At the time of reporting the site is offline and no additional page content has been captured. Defenders should continue to block the domain at network perimeters, monitor for reuse of the same IP address or nameserver pair, and add the domain to internal blacklists. Because the hosting uses a reputable CDN, threat‑hunting teams should also watch for other domains sharing the same Cloudflare account or IP range. Ongoing review of VirusTotal and additional vendor feeds is recommended to detect potential re‑registration or variant activity.