start-leedgr-en[.]pages[.]dev

This domain, start-leedgr-en.pages.dev, is actively serving HTTP 200 responses and presents the page title “Get started with Ledger — Ledger.com/start®”. The site is hosted on Cloudflare infrastructure, using the IP address 172.66.47.111 located in Canada and authoritative name servers elma.ns.cloudflare.com and jihoon.ns.cloudflare.com. TLS is provided by Google Trust Services under the WE1 certificate, and the site enforces HSTS while supporting HTTP/3. VirusTotal analysis shows that six of ninety‑four scanners have flagged the domain, and it appears on one external blocklist. The domain was registered on 30 March 2026 via Cloudflare, Inc., and its Gridinsoft trust score is 0/100. Security researchers have associated the site with a “Seed Phrase Phishing” kit and classified it as a Ledger brand impersonation campaign. The domain is currently blocked by PhishDestroy, but no additional public evidence of the page’s content or credential‑capture mechanisms is available. Defenders should add the domain and its resolved IP address to deny‑list rules, monitor for any new sub‑domains or similar Cloudflare‑hosted URLs, and educate users that any unsolicited Ledger onboarding flow originating from a pages.dev URL is malicious. Ongoing telemetry should be collected to confirm whether the site begins delivering malicious payloads or exfiltrating data.