leedger-com-start-us[.]pages[.]dev

This domain, leedger-com-start-us.pages.dev, is flagged as an active phishing site targeting users of Ledger hardware wallets. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.44.172 and uses Cloudflare nameservers (autumn.ns.cloudflare.com and randy.ns.cloudflare.com). As of July 29, 2026, the domain appears on at least one security blocklist and is blocked by PhishDestroy. VirusTotal analysis indicates that 11 out of 91 security vendors classify this domain as malicious, though the specific detection rules or signatures are not disclosed in the available data.

Infrastructure analysis reveals the domain is hosted on Cloudflare Pages, a platform often used for static site hosting, which may complicate takedown efforts due to Cloudflare's proxy services. The use of a subdomain structure (leedger-com-start-us) suggests an attempt to mimic legitimate Ledger domains, though no direct evidence of the page content or phishing kit in use is currently available. The exact nature of the phishing attempt—whether credential harvesting, cryptocurrency theft, or firmware-related scams—remains unconfirmed, as the site's content has not been fully analyzed.

Defenders should treat this domain as high-risk due to its association with a well-known cryptocurrency hardware brand and the presence of detections from multiple security vendors. Recommended actions include blocking the domain at the DNS or firewall level, monitoring for connections to the associated IP (172.66.44.172), and alerting users to potential phishing risks related to Ledger wallet interactions. Further investigation into the domain's HTTP responses, SSL certificate details, and any linked infrastructure may provide additional indicators of compromise (IOCs).