sta--rt-ledgr[.]pages[.]dev

Analysis of sta--rt-ledgr.pages.dev, observed on July 24 2026, shows a domain registered on March 22 2026 through Cloudflare, Inc. The domain resolves to IP 188.114.96.3, an address belonging to Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare name servers gabriel.ns.cloudflare.com and violet.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (issuer WE1). HTTP requests return a 403 status code, indicating access denial, and the site advertises HSTS, HTTP/3, and Cloudflare services.

The page title “Official Site® | Ledger.com/Start® | Getting started with handing” explicitly references Ledger, confirming a brand‑impersonation attempt targeting Ledger users, and the threat is classified as a crypto scam. VirusTotal analysis reported 17 detections out of 94 scanners, and the domain appears on a single security blocklist, with PhishDestroy actively blocking it. Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious reputation. Current operational status is offline, and no additional content has been captured.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as the site returns only a 403 response and no page content has been retrieved. Defenders should update intrusion detection signatures to flag any DNS resolution to 188.114.96.3 associated with the domain, enforce outbound filtering for HTTP/HTTPS requests to this host, and add the domain to blocklists across email and web gateways. Monitoring for new subdomains under pages.dev that mimic Ledger branding is also advised, as the infrastructure (Cloudflare hosting and Google‑issued TLS) may be reused for future campaigns.