us-en-ledgr-pages-dev[.]pages[.]dev

Analysis of us-en-ledgr-pages-dev.pages.dev, created on February 21 2026, shows a dedicated infrastructure designed to impersonate Ledger’s wallet onboarding flow. The site presents the page title “Get Started with Ledger Wallet,” directly targeting the Ledger brand and matching the reported scam type of Wallet/Seed Phishing. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating a legitimate‑looking HTTPS endpoint. The domain is hosted on Cloudflare’s network (AS13335) and resolves to IP 172.66.47.90, a Cloudflare edge node located in the United States.

DNS is managed by Cloudflare‑provided nameservers (gabe.ns.cloudflare.com, stephane.ns.cloudflare.com). The web server enforces HTTP Strict Transport Security and supports HTTP/3, confirming modern configuration. HTTP responses return a 403 status, and the site is currently taken offline. Threat‑intel feeds have flagged the domain: one security vendor on VirusTotal identified malicious activity, it appears on a single blocklist, and PhishDestroy has actively blocked it.

The Gridinsoft trust score of 0 / 100 further signals a high‑risk profile. While the page content has not been directly examined, the combination of brand impersonation, wallet‑related title, and low trust metrics provides strong evidence of a credential‑stealing campaign targeting Ledger users. Defenders should add the domain and its IP address to blocklists, monitor Cloudflare edge ranges for similar patterns, and educate end users that any Ledger onboarding request originating from a pages.dev subdomain is unauthenticated. Continuous re‑scanning of the domain is recommended in case the site re‑appears, and any related phishing URLs should be reported to relevant brand‑protection teams.