ledger-comstart-en[.]pages[.]dev

On 24 July 2026, the domain ledger-comstart-en.pages.dev was identified as a brand‑impersonation infrastructure targeting Ledger customers. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.195, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3. An HTTP request returns a 403 status code and the page title is "Suspected phishing site | Cloudflare," indicating that Cloudflare has taken the site down. The infrastructure uses the nameservers holly.ns.cloudflare.com and yoxall.ns.cloudflare.com, both standard Cloudflare resolvers.

Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. It is actively blocked by PhishDestroy, and VirusTotal recorded 14 detections out of 93 scanners, reinforcing the malicious classification. The site is explicitly linked to a crypto‑scam campaign that impersonates the Ledger brand, as reflected in the provided intelligence.

While the exact content of the phishing page has not been captured, the convergence of low trust scores, blocklist presence, multiple vendor detections, and the Cloudflare takedown page provides strong evidence of malicious intent. Defenders should immediately block ledger-comstart-en.pages.dev and its associated IP address 172.66.44.195 at perimeter firewalls and DNS filters. Continuous monitoring of Cloudflare‑hosted assets for similar naming patterns, as well as periodic re‑scanning of the domain, is advised to detect any future re‑activations.