ledgercomstartt[.]pages[.]dev

ledgercomstartt.pages.dev was registered through Cloudflare on 21 February 2026 and immediately pointed to Cloudflare’s edge IP 172.66.44.127, which belongs to AS13335 in the United States. The domain resolves to a server that presents a Google Trust Services WE1 certificate and enforces HTTP Strict Transport Security, HTTP/3, and Cloudflare caching. An HTTP request returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, indicating that the content has been taken down or blocked. Threat intelligence flags the domain as a crypto‑related brand impersonation targeting Ledger.

VirusTotal records show 11 of 95 scanned security vendors labeling the site as malicious, and the domain appears on a single external blocklist. Independent reputation services assign a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, reinforcing the high confidence of abuse. The site is currently listed as offline by PhishDestroy and other monitoring services. While the exact payload or credential‑collection mechanism has not been publicly disclosed, the combination of low reputation scores, vendor detections, and the explicit “Crypto Scam” classification suggests the domain was used to lure Ledger users into submitting cryptocurrency wallet information or private keys.

Defenders should block DNS resolution for ledgercomstartt.pages.dev, add the IP address 172.66.44.127 to network deny lists, and monitor for any similar Cloudflare‑hosted subdomains that reference Ledger. Incident response teams should also review logs for attempts to contact this domain and consider notifying affected Ledger users of the observed impersonation attempt. Ongoing surveillance of Cloudflare‑registered domains with low trust scores is recommended to catch future iterations early.