hone-ldger-io[.]pages[.]dev

Analysis of the domain hone-ldger-io.pages.dev indicates it is being used for a brand‑impersonation campaign targeting Ledger users. The site was created on March 23, 2026 and is presently offline, returning HTTP 403 responses. VirusTotal records show that 13 of 94 security vendors have flagged the host, and it appears on a single public blocklist maintained by PhishDestroy. The registrar is Cloudflare, Inc., with authoritative nameservers anirban.ns.cloudflare.com and joselyn.ns.cloudflare.com.

Infrastructure inspection reveals the domain resolves to IP 188.114.96.3, an address associated with Cloudflare's network in Canada. The service presents HSTS, Cloudflare edge features, and HTTP/3 support, while the TLS certificate is issued by Google Trust Services (WE1) and is valid for the host. A Gridinsoft trust score of 0 / 100 further reflects the malicious nature of the infrastructure. The page title captured from the site reads “Getting Started — Ledger (Quick 1000‑word Presentation)”, confirming a direct attempt to mimic Ledger’s onboarding materials.

The campaign is classified as a crypto‑scam, suggesting intent to harvest cryptocurrency credentials or funds. What remains uncertain is the exact phishing kit or payload delivered, as the site content has not been publicly archived. Defenders should block the domain and its resolving IP at perimeter defenses, update URL filtering and threat‑intel feeds, and monitor for any future re‑hosting of the same content under different subdomains. Incident response teams handling Ledger‑related alerts should treat any authentication attempts from this host as malicious and advise users to verify Ledger communications through official channels only.