ledger-en-desktop[.]pages[.]dev

The domain ledger-en-desktop.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline. Technical analysis shows the site employed HSTS, Cloudflare edge services, and HTTP/3, indicating use of modern web delivery mechanisms. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, and the domain resolves to the Cloudflare IP address 172.66.44.135, which is allocated to AS13335 in the United States. Nameserver records point to jillian.ns.cloudflare.com and rex.ns.cloudflare.com, confirming the domain’s reliance on Cloudflare’s DNS infrastructure.

The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting the site was deliberately shut down or restricted. Security telemetry indicates the site appears on a single blocklist, specifically PhishDestroy, and a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded nine detections out of ninety-three scanned vendors, reinforcing the suspicion of abuse.

The site is classified as a crypto‑related scam targeting the Ledger brand, and the risk rating has been elevated. Defenders should immediately block both the domain and its associated IP address at perimeter and DNS layers, enforce strict outbound filtering for Cloudflare edge nodes, and monitor for any future registration of similar ledger‑related subdomains on the pages.dev namespace. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should treat any credential or wallet information potentially exposed to this infrastructure as compromised.