ledgr-desktop-live[.]pages[.]dev

The domain ledgr-desktop-live.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.167, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are jade.ns.cloudflare.com and west.ns.cloudflare.com, indicating that the infrastructure is fully hosted behind Cloudflare's edge network. The site presented the page title "Suspected phishing site | Cloudflare" and returned an HTTP 403 status, consistent with Cloudflare's default block response for malicious content. An SSL certificate issued by Google Trust Services under the WE1 designation was observed, confirming the use of a valid TLS certificate despite the malicious intent.

The domain is classified as a crypto scam that impersonates the Ledger brand, and it has been flagged by 16 of 93 security vendors on VirusTotal. Additional security signals include a Gridinsoft trust score of 0/100, detection on one public blocklist, and active blocking by PhishDestroy. Detected technologies comprise HTTP/3, HSTS enforcement, and Cloudflare's CDN services.

The site is currently offline, having been taken down, but the underlying infrastructure remains observable. Defenders should add the domain and its associated IP to network blocklists, monitor for new subdomains under the pages.dev namespace that reference Ledger or cryptocurrency themes, and maintain vigilance for similar Cloudflare‑hosted impersonation attempts. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators of compromise.