ledger-com-app-start-azf[.]pages[.]dev

Analysis of ledger-com-app-start-azf.pages.dev indicates a confirmed crypto‑related impersonation of the Ledger brand. The domain was registered on March 23, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.130, which is geolocated to Canada. The site presented the page title Secure Wallet Setup | Digital Asset Security, matching the declared scam type of a crypto scam and the targeted brand Ledger. Technical inspection shows the presence of HSTS, Cloudflare edge services, and HTTP/3 support, all delivered under a Google Trust Services / WE1 SSL certificate.

HTTP responses returned a 403 status, and the site is currently taken offline. Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records seven detections out of ninety‑four scanned security vendors. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy service. Nameservers carol.ns.cloudflare.com and igor.ns.cloudflare.com confirm the Cloudflare hosting relationship.

While the offline status limits further content analysis, the convergence of brand impersonation, malicious page title, low trust score, multiple vendor detections, and blocklist presence provides strong evidence of a credential‑harvesting or crypto‑draining operation. Defenders should add the domain and its associated IP address to URL filtering and host‑based blocklists, monitor for any re‑hosting on other Cloudflare‑controlled subdomains, and enforce strict outbound traffic controls for ledger‑related URLs. Continuous threat‑intel feeds should be consulted for potential reuse of the same infrastructure in related campaigns.