leddger-com-stat[.]pages[.]dev

The domain leddger-com-stat.pages.dev was registered on 23 March 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 188.114.97.3 located in Canada. Nameserver records list becky.ns.cloudflare.com and bryce.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. A TLS certificate issued by Google Trust Services under the WE1 root is presented, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, indicating a modern web stack typically associated with legitimate services. The only content retrieved during the brief online window was a page titled “Get Started with Ledger — Ledger.com/start”, directly referencing Ledger’s official branding.

The HTTP response code returned was 403, which may indicate a deliberate block or a misconfiguration, but the presence of Ledger’s brand name and the "Crypto Scam" classification in intelligence sources aligns the domain with a brand‑impersonation campaign aimed at Ledger users. VirusTotal analysis shows 14 of 94 security scanners flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one defensive feed has taken action.

Despite these indicators, the site is currently offline, limiting dynamic analysis of payloads or credential‑capture mechanisms. No additional artifacts such as phishing form URLs, malware hashes, or C2 endpoints have been observed, leaving the exact attack vector uncertain. The pages.dev sub‑domain is a generic hosting tier provided by Cloudflare, which often hosts user‑generated content; malicious actors frequently leverage such infrastructure to gain credibility while remaining behind Cloudflare’s protective services.