service-ledger-help[.]pages[.]dev

service-ledger-help.pages.dev is currently active and resolves to the Cloudflare edge address 188.114.96.3 located in Canada. The domain was created on 30 April 2026 and is hosted behind Cloudflare, using HSTS and HTTP/3, with a Google Trust Services certificate issued for the WE1 trust anchor. The page title observed, “Ledger Start – Set Up Your Hardware Wallet,” indicates a brand‑impersonation attempt targeting Ledger users. The domain appears on one security blocklist and is listed by PhishDestroy as malicious. VirusTotal has recorded 12 detections out of 91 scanners, and Gridinsoft assigns a trust score of 0 / 100. Nameservers are gene.ns.cloudflare.com and nero.ns.cloudflare.com. While the exact payload or credential‑collection mechanism has not been publicly disclosed, the combination of recent registration, brand‑specific title, and multiple security vendor flags strongly suggests a phishing or credential‑harvesting campaign. Defenders should block the domain at DNS and web‑filter layers, monitor outbound connections to the associated IP, and advise users not to enter Ledger credentials on any site that does not match official Ledger domains. Ongoing observation is recommended to capture any changes in content or infrastructure.