us-e-n-ledgr[.]pages[.]dev

The domain us-e-n-ledgr.pages.dev was registered on April 29 2026 via Cloudflare, Inc. It resolves to 188.114.96.3, an IP owned by Cloudflare, Inc. in Canada. The site presents a page titled “Get Started with Ledger Wallet — Colorful 1000‑Word Guide” and is classified as a brand‑impersonation campaign targeting Ledger. SSL is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS certificate but offering no assurance of legitimacy. DNS is served by Cloudflare nameservers monroe.ns.cloudflare.com and viddy.ns.cloudflare.com. HTTP response code 200 is returned, and the server advertises HSTS and HTTP/3, confirming the use of modern web security features. VirusTotal reports 7 of 91 security vendors flagging the domain, and the site appears on at least one public blocklist and is already blocked by PhishDestroy. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. Current intelligence marks the infrastructure as active. Defenders should add the domain and its resolving IP to outbound filtering rules, monitor DNS queries for the Cloudflare name servers, and ensure that any credential‑capture alerts referencing Ledger‑related keywords are correlated with this indicator. Ongoing observation is recommended to detect any evolution of the phishing kit or additional infrastructure.