guide-desktop-en-us-ledg[.]pages[.]dev

Analysis of the domain guide-desktop-en-us-ledg.pages.dev indicates it was a brand impersonation site targeting Ledger, a cryptocurrency wallet provider. The domain, registered on March 23, 2026, through Cloudflare, Inc., resolved to the IP address 172.66.44.241, hosted in California under Cloudflare's infrastructure. The page title, 'Ledger Live Hub™ | Desktop Wallet Management,' directly mimics Ledger's official branding, aligning with the reported scam type classified as a crypto scam. The domain was flagged by one security blocklist and blocked by PhishDestroy, with a Gridinsoft trust score of 0/100, reflecting high suspicion.

VirusTotal scans detected the domain as malicious by 2 of 94 security vendors, though this does not represent exhaustive coverage. The SSL certificate, issued by Google Trust Services (WE1), is consistent with Cloudflare-hosted domains but does not validate the site's legitimacy. Technologies detected include HSTS, Cloudflare, and HTTP/3, typical of modern web infrastructure but also commonly exploited by threat actors to lend credibility. The domain's HTTP status was 403 at the time of assessment, suggesting it may have been taken offline or restricted.

Nameservers (aaron.ns.cloudflare.com, nelci.ns.cloudflare.com) further confirm Cloudflare as the hosting provider. Defenders should treat this domain as compromised and avoid any interaction. Organizations should update blocklists to include this domain and monitor for related infrastructure, such as similarly named subdomains or IPs within Cloudflare's range. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, low trust scores, and detection by security vendors confirms its malicious intent.