ledgercom-start-cby[.]pages[.]dev

Analysis indicates that ledgercom-start-cby.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The site presents the page title “Suspected phishing site | Cloudflare” and is classified in the intelligence as a crypto‑related scam that impersonates the Ledger brand. VirusTotal scans have returned detections from 10 of 93 security vendors, and the domain appears on a single external blocklist. The HTTP response is 403, the server enforces HSTS, and traffic is delivered over HTTP/3 via Cloudflare. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid, publicly trusted certificate.

Gridinsoft’s trust score is 0 / 100, reflecting a high‑confidence malicious rating. The nameservers listed are peyton.ns.cloudflare.com and fiona.ns.cloudflare.com. The domain has been taken offline and is listed as blocked by PhishDestroy. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because the content of the page has not been captured; the only available artifact is the generic page title. No additional intelligence such as Safe Browsing alerts, OTX indicators, or detailed malware hashes is present.

Consequently, the exact technique used to target Ledger users cannot be confirmed beyond the brand‑impersonation label. Defenders should add 188.114.96.3 to network egress filtering deny lists, monitor DNS queries for ledgercom-start-cby.pages.dev and its Cloudflare nameservers, and ensure that any endpoint protection that references the 10 VirusTotal detections flags the domain as malicious. Block the domain on web proxies and update URL filtering rules to include the observed page title. Because the domain is hosted on Cloudflare, consider applying Cloudflare‑specific threat‑intelligence feeds that capture newly registered subdomains.