hame-ldger-io[.]pages[.]dev

This domain, hame-ldger-io.pages.dev, is currently active and was registered on March 28, 2026. DNS resolution points to IP address 172.66.45.7, which is hosted by Cloudflare, Inc. in Canada. The domain is served through Cloudflare’s infrastructure, as indicated by the presence of HSTS, HTTP/3 support, and the SSL certificate issued by Google Trust Services under the WE1 identifier. Nameserver records list anirban.ns.cloudflare.com and joselyn.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The page title returned by the web server is "Getting Started — Ledger (Quick 1000‑word Presentation)", and the threat is classified as brand impersonation targeting the Ledger brand. VirusTotal has flagged the domain on 9 of 94 security vendors, and it appears on one public blocklist, currently blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and the HTTP response code is 200, indicating successful content delivery. Evidence suggests a high‑risk phishing campaign designed to lure Ledger users, though the exact payload or credential‑capture mechanisms have not been disclosed. Defenders should include the domain and its associated IP address in URL filtering and endpoint blocklists, monitor for related DNS queries, and consider threat‑intelligence sharing with partners. Continued observation is advised to capture any evolution of the hosting infrastructure or additional indicators of compromise.