hom--e-en-ledgr[.]pages[.]dev

The domain hom--e-en-ledgr.pages.dev was registered through Cloudflare, Inc. on March 22, 2026 and is presently taken offline. DNS resolution points to the Cloudflare‑owned address 188.114.96.3, which resolves to a Canadian location associated with Cloudflare, Inc. The authoritative nameservers are carla.ns.cloudflare.com and duke.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. The site presented the page title "Ledger Start - Secure Your Crypto," and explicitly impersonates the Ledger brand, aligning with a crypto‑scam classification. HTTPS is enforced via HSTS and the SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid TLS configuration despite the malicious intent. HTTP requests return a 403 status code, suggesting that the content is no longer publicly accessible. Technical fingerprints include support for HTTP/3, further confirming the Cloudflare front‑end.

Threat‑intelligence aggregators have flagged the domain. VirusTotal recorded 11 detections out of 94 scanned security vendors, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. The elevated risk level is consistent with the brand‑impersonation and crypto‑scam indicators.

While the domain is offline, its recent creation date and the observed infrastructure suggest a short‑lived campaign designed to leverage Ledger’s brand reputation. Defenders should continue to monitor for any resurgence of the domain or related subdomains, enforce blocklist updates that include the IP 188.114.96.3, and apply URL filtering rules for the exact page title phrase. Organizations that handle cryptocurrency assets should educate users about unsolicited prompts referencing Ledger and advise verification through official Ledger channels.