strrt-ledgor-io[.]pages[.]dev

The domain strrt-ledgor-io.pages.dev was registered on April 05, 2026 through Cloudflare, Inc. and is currently resolved to the IP address 188.114.96.3, which belongs to Cloudflare’s infrastructure in Canada. The authoritative nameservers listed are clara.ns.cloudflare.com and sri.ns.cloudflare.com, confirming that the domain’s DNS is fully managed by the same provider. The site returns HTTP status code 200 and presents a page titled "Ledger Start Page," directly mimicking the official Ledger brand landing page. This visual alignment, combined with the brand_impersonation classification, indicates a deliberate attempt to deceive Ledger users into providing credentials or personal information.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating an exceptionally low reputation. The SSL certificate is issued by Google Trust Services under the identifier WE1, which is typical for Cloudflare‑served sites but does not mitigate the underlying malicious intent. VirusTotal has flagged the domain in 3 of 95 security vendor scans, and the domain appears on a single security blocklist, where it is recorded as blocked by PhishDestroy. Although the detection count is modest, the presence of any vendor flags, combined with the high‑risk brand‑impersonation label, underscores the likelihood of credential‑phishing activity.

Defenders should treat strrt-ledgor-io.pages.dev as an active high‑risk threat. Immediate actions include adding the domain and its resolving IP 188.114.96.3 to web‑filter deny lists, monitoring for any outbound connections from internal hosts to this address, and deploying email security rules to block messages that reference the "Ledger Start Page" title or contain URLs matching the pages.dev subdomain pattern. Continuous re‑evaluation is advised, as additional security vendors may raise their detection count, and the domain could be propagated to other blocklists or phishing kits in the near future.