ledger-log[.]pages[.]dev

The domain ledger-log.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.44.64, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative name servers are yew.ns.cloudflare.com and joyce.ns.cloudflare.com, and the site presents an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS termination path. HTTP requests to the host return a 403 status code, and the page title returned by Cloudflare reads "Suspected phishing site | Cloudflare," confirming that the service has flagged the site as malicious. The domain is categorized as a crypto‑related scam that specifically impersonates the Ledger brand, as indicated by the supplied brand target field.

Security telemetry shows that the domain appears on a single security blocklist and has been taken offline by the PhishDestroy mitigation service. A trust scoring engine from Gridinsoft assigns a score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis records four detections out of ninety‑three scanned security vendors, reinforcing the suspicion of abuse. Automated fingerprinting identifies the use of HSTS, Cloudflare’s edge network, and HTTP/3 protocol support, all of which are consistent with a fast‑moving phishing infrastructure.

Defenders should continue to block the IP 172.66.44.64 at the network perimeter and ensure that any outbound connections to ledger-log.pages.dev are denied. Updating DNS sinkhole lists to include the domain and its associated nameservers will prevent internal resolution. Monitoring for similar Cloudflare‑hosted subdomains that reference Ledger or exhibit the same SSL certificate chain is recommended, as threat actors frequently reuse the same hosting environment for new impersonation campaigns.