desktop-ledger-eng[.]teachable[.]com

desktop-ledger-eng.teachable.com was registered on 21 February 2026 through Amazon Registrar, Inc. The domain resolves to the IPv4 address 34.54.192.65, which belongs to Google LLC (AS396982) and is geolocated in the United States. DNS resolution uses Cloudflare name servers ian.ns.cloudflare.com and nina.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WR3 label, indicating a valid HTTPS endpoint. HTTP probing returned a 404 status code while the page title reported by the scanner was “403”, suggesting the endpoint is currently inaccessible. Technology fingerprinting identified Google Cloud hosting, Google Cloud CDN, HTTP/3 support, HSTS enforcement, and the use of Mailgun for outbound mail services.

The campaign is classified as a brand impersonation targeting Ledger and is associated with a crypto‑scam motive. VirusTotal recorded a single positive detection out of 93 scanned security vendors, and the domain appears on one external blocklist. PhishDestroy also reports the domain as blocked. The combination of a recent registration, cloud‑based infrastructure, and limited detection coverage indicates a low‑profile but potentially active malicious operation. Defenders should add the domain and its resolving IP to network‑level blocklists, monitor for any future DNS changes, and enforce TLS inspection to detect possible credential‑harvesting traffic.

Because Mailgun is present, outbound email traffic to the domain should be scrutinized for phishing attempts. Continuous re‑scanning with VirusTotal and other multi‑engine services is advised to capture any escalation in detection counts. The exact content of the landing page could not be captured because the site returned HTTP errors, but the current offline status suggests a takedown is in effect. Threat actors may migrate to similar subdomains under the teachable.com parent; security teams should watch for new Ledger‑related subdomains and block them proactively.