ledger-com-start-8ph[.]pages[.]dev

This domain, ledger-com-start-8ph.pages.dev, was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.47.87 (AS13335, United States). The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status, indicating that direct content retrieval is blocked. Technical fingerprints show the use of HSTS, HTTP/3, and Cloudflare‑provided DNS with authoritative name servers abdullah.ns.cloudflare.com and ryleigh.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid SSL chain.

Threat intelligence flags the domain as a Ledger brand impersonation and classifies the activity as a crypto‑related scam. VirusTotal analysis records 17 detections out of 95 scanned security vendors, and the domain appears on a single external blocklist. Independent reputation services assign a zero‑score rating: Gridinsoft reports 0 / 100 and Scamadviser also reports 0 / 100, both indicating extreme mistrust. PhishDestroy has already blocked the domain.

The evidence demonstrates a deliberately crafted malicious infrastructure leveraging reputable hosting and TLS services to increase credibility while targeting Ledger users for cryptocurrency theft. The current offline status suggests that the operators have taken the site down, but the infrastructure – including the Cloudflare IP and name‑server configuration – remains reusable for future campaigns. Defenders should add the domain and its associated IP address to local blocklists, monitor for any re‑registration of similar sub‑domains under the same name‑servers, and enforce strict URL filtering for Ledger‑related traffic. Continuous monitoring of VirusTotal and other multi‑engine scanners for re‑emergence is also recommended.