ledgerlogin-0home[.]pages[.]dev

The domain ledgerlogin-0home.pages.dev resolves to the Cloudflare edge address 172.66.47.61, indicating that the infrastructure is hosted behind Cloudflare’s CDN. The domain was created on 21 February 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers algin.ns.cloudflare.com and janet.ns.cloudflare.com. TLS termination is performed by Google Trust Services, presenting a WE1 certificate that is valid for the host name, which confirms the use of a legitimate certificate authority but does not mitigate the impersonation risk. An HTTP request returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, a generic Cloudflare warning page that appears when content has been removed or blocked.

The site also enforces HTTP Strict Transport Security and negotiates HTTP/3, consistent with modern Cloudflare deployments. Reputation checks show a Gridinsoft trust score of 0 / 100 and a detection count of 11 out of 93 security vendors on VirusTotal, indicating multiple scanners have flagged the domain as malicious. The domain appears on at least one public blocklist, PhishDestroy, which classifies it as a crypto‑related scam impersonating the Ledger brand. Current status is reported as offline, meaning the site is no longer reachable, but the underlying IP and hosting remain active.

The combination of a newly registered domain, Cloudflare‑provided infrastructure, a low trust score, multiple vendor detections, and explicit blocklist classification points to a deliberate attempt to deceive Ledger users. The exact content served before takedown has not been captured, so the precise phishing workflow remains unknown. Defenders should block resolution to 172.66.47.61 for any Ledger‑related traffic, add ledgerlogin-0home.pages.dev to URL filtering policies, and monitor for similar subdomains under the pages.dev namespace that use the “ledgerlogin” keyword.