ledger-io-strert[.]pages[.]dev

The domain ledger-io-strert.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and uses the Cloudflare nameservers aliza.ns.cloudflare.com and tate.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.149, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 identifier, indicating that TLS termination is performed by Cloudflare. HTTP probing returns a 403 status code and the page title reported by the server is "Suspected phishing site | Cloudflare".

Technical fingerprints include HSTS enforcement, HTTP/3 support, and the Cloudflare edge platform, all consistent with the hosting provider’s infrastructure. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser reports 10 / 100, and the domain appears on a single security blocklist (PhishDestroy). VirusTotal analysis shows that 11 of 93 scanning engines flag the domain as malicious, which aligns with its classification as a brand impersonation campaign targeting Ledger.

The site is currently taken offline, but the observed infrastructure suggests a short‑lived phishing deployment that leveraged Cloudflare’s free hosting to obtain a legitimate certificate and evade simple static checks. Defenders should immediately block the domain and its resolving IP at network perimeters, ensure that endpoint protection solutions incorporate the VirusTotal detection set, and monitor for future registrations that reuse the same nameserver pair or similar sub‑domain patterns under the pages.dev namespace. Continuous observation of Cloudflare‑hosted malicious domains is advised, as the provider’s shared infrastructure can be repurposed rapidly for new impersonation attempts.