support-ledgrcom--helps--us[.]pages[.]dev

The domain support-ledgrcom--helps--us.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.84, which is associated with Cloudflare’s Canadian edge network. The authoritative nameservers listed are adrian.ns.cloudflare.com and rob.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. An SSL certificate issued by Google Trust Services (WE1) protects the site, and the service advertises HSTS and HTTP/3, indicating modern HTTPS configuration. HTTP requests to the domain return a 403 status code, and the current operational state is marked as offline, meaning no content is presently being served.

The page title retrieved from the domain is "Get Started with Ledger — Ledger.com/start," directly referencing Ledger’s official branding, and the threat classification identifies the domain as a crypto‑related scam impersonating Ledger. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 15 of 94 scanned security vendors flagged the domain, providing independent confirmation of malicious intent. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy, reinforcing the assessment of malicious activity.

The overall evidence – including the low trust score, vendor detections, blocklist presence, brand impersonation, and the crypto‑scam label – supports an elevated risk rating. Defenders should add the domain to network and email blocklists, monitor for any reactivation or similar domain registrations, and consider extending detection rules to cover patterns of double‑dash and multi‑segment subdomains that target Ledger‑related users. Continuous observation of Cloudflare‑hosted infrastructure associated with this IP range is advised to detect potential re‑use of the same hosting for future impersonation attempts.