ledge-start-review-us[.]pages[.]dev

This domain, ledge-start-review-us.pages.dev, was registered on March 22 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which is located in the Cloudflare network in Canada. The authoritative nameservers are abby.ns.cloudflare.com and vick.ns.cloudflare.com. The site presents the page title “Ledger.com Start | Secure Your Cryptocurrency with Ledger Wallet”, indicating a direct impersonation of the Ledger brand. The SSL certificate is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑hosted sites, and the connection enforces HSTS and HTTP/3. An HTTP request returns a 403 status code, suggesting the content is currently inaccessible.

Security telemetry shows the domain is listed on a single blocklist and was blocked by PhishDestroy. VirusTotal analysis recorded ten detections out of ninety‑four scanners, confirming malicious classification by multiple vendors. The Gridinsoft trust score is 0 / 100, reinforcing the low reputation. The campaign is categorized as a crypto scam, targeting users seeking Ledger wallet services.

At the time of this report the domain is offline, which may be a temporary takedown or an operational pause. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the same sub‑domain or similar “pages.dev” clones, and update threat‑intel feeds with the observed indicators of compromise. Additional investigation is needed to retrieve the page content, confirm the exact phishing kit, and determine whether the 403 response was intentional or a result of takedown actions. Until the site is re‑hosted, the existing evidence warrants maintaining the elevated risk rating and treating any traffic to this host as malicious.