ledger-org[.]pages[.]dev

Analysis of ledger-org.pages.dev indicates that the domain is being used for a Ledger brand impersonation campaign classified as a crypto scam. The site returned an HTTP 403 response and the page title displayed "Suspected phishing site | Cloudflare," confirming that the hosting provider has taken the page offline. Domain registration took place on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers are skip.ns.cloudflare.com and zoe.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.182, which belongs to AS13335 Cloudflare, Inc. in the United States.

The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, a standard Cloudflare‑provided certificate. Reputation services show extreme distrust: Gridinsoft assigns a score of 0 / 100, Scamadviser rates the domain 1 / 100, and VirusTotal reports nine of ninety‑three security vendors flagging the domain as malicious. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Detected technologies include HTTP/3, HSTS, and Cloudflare’s edge services.

While the exact phishing page content has not been examined, the combination of brand impersonation, crypto‑related scam labeling, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor for any re‑registration attempts. Additional investigation of any related subdomains or similar‑named registrations is advised, as threat actors often reuse infrastructure. The current evidence base is sufficient to classify ledger‑org.pages.dev as a confirmed Ledger impersonation scam with elevated risk.