start-en-ledgger[.]pages[.]dev

This domain start-en-ledgger.pages.dev is currently active and resolves to 188.114.97.3, an address owned by Cloudflare, Inc. in Canada. The site presents a page title "Ledger Live: Trusted Crypto Wallet & Portfolio Manager" and is classified as a brand‑impersonation campaign targeting Ledger. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid SSL handshake. HTTP response code 200 is returned and the server advertises HSTS, Cloudflare protections and HTTP/3 support. Registration occurred on 30 April 2026 through Cloudflare, Inc., using the nameservers amit.ns.cloudflare.com and laila.ns.cloudflare.com. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans show 5 detections out of 91 engines, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of malicious use. No additional content analysis is available beyond the page title, so the exact phishing workflow cannot be confirmed at this time. Defenders should block DNS resolution for start‑en‑ledgger.pages.dev, add the IP 188.114.97.3 to network deny lists, and monitor for any outbound connections to Cloudflare‑hosted resources that reference Ledger branding. Incident response teams should treat any credentials submitted to this domain as compromised and advise affected users to reset Ledger‑related passwords and revoke any associated authentication tokens.