start-legrlive-cdn[.]pages[.]dev

The domain start-legrlive-cdn.pages.dev was registered through Cloudflare, Inc. on 23 March 2026 and resolves to the Cloudflare edge address 188.114.97.3 located in Canada. The authoritative nameservers evan.ns.cloudflare.com and linda.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. TLS termination is provided by a Google Trust Services certificate issued to the WE1 authority, and the site advertised HTTP Strict Transport Security, Cloudflare caching, and HTTP/3 support. An HTTP request to the host returned a 403 status code, indicating that the resource is presently inaccessible; the domain is listed as taken offline in the current intelligence feed.

Brand‑targeting evidence consists of the page title “Official Ledger Start — Stylish Setup” and the classification of the campaign as a Ledger impersonation within a crypto‑scam context. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal analysis recorded 2 detections out of 94 scanned security vendors, corroborating the presence of malicious indicators. The Gridinsoft trust score of 0 / 100 further reflects a high confidence of abuse.

While the exact payload or credential‑harvesting pages have not been retrieved, the combination of brand‑specific metadata, low trust score, and multiple vendor detections suggests a coordinated attempt to deceive Ledger users. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and incorporate the IP address 188.114.97.3 into threat‑intel feeds. Ongoing observation of Cloudflare‑associated domains for similar naming patterns is recommended to pre‑empt future impersonation campaigns.