alone-ledgr-com-strt[.]pages[.]dev

Analysis of the domain alone-ledgr-com-strt.pages.dev indicates a brand‑impersonation campaign targeting Ledger users. The site was registered on March 23 2026 and resolves to the Cloudflare address 172.66.44.166, which is geolocated to Canada and is owned by Cloudflare, Inc. The domain is hosted behind Cloudflare’s infrastructure, employing HSTS and HTTP/3, and presents a TLS certificate issued by Google Trust Services (WE1). The page title retrieved from the live endpoint reads “Ledger Wallet Initialization: Secure Your Crypto from Day One,” directly referencing Ledger’s product line. An HTTP request to the host returns a 403 status code, and the domain is currently listed as taken offline.

Reputation services have flagged the domain: VirusTotal reports detections by 11 of 94 scanners, it appears on one public blocklist, and PhishDestroy has actively blocked it. Additional security scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. Nameservers carlos.ns.cloudflare.com and zariyah.ns.cloudflare.com confirm the use of Cloudflare’s DNS services.

While the available data confirms the presence of Ledger brand impersonation and a malicious hosting setup, no payload samples, credential‑harvesting forms, or further C2 infrastructure have been observed, leaving the exact victim‑interaction mechanism uncertain. Defenders should add the full sub‑domain to local and network‑level blocklists, monitor Cloudflare for any re‑registration attempts, and issue user‑awareness advisories warning Ledger customers that any site with this URL is not affiliated with the official Ledger service. Continuous observation of VirusTotal and other intelligence feeds is recommended to capture any future activity associated with this infrastructure.