ledger-com-start-in[.]pages[.]dev

The domain ledger-com-start-in.pages.dev was observed delivering an HTTP 403 response and is currently listed as taken offline. DNS resolution points to 172.66.46.212, which belongs to Cloudflare’s network (AS13335, United States). The authoritative nameservers are owen.ns.cloudflare.com and susan.ns.cloudflare.com, indicating the domain is registered through Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the presence of HTTPS. HTTP headers include Strict‑Transport‑Security and the site supports HTTP/3, both typical of Cloudflare‑enabled services. Reputation services rate the domain poorly: Scamadviser assigns a trust score of 41 / 100, Gridinsoft scores 0 / 100, and the domain appears on a single security blocklist.

PhishDestroy has actively blocked it. VirusTotal analysis shows that 10 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of abuse. The page title returned by the server is “Suspected phishing site | Cloudflare”, which aligns with the classification of a crypto‑related scam. The intelligence explicitly states the site impersonates the Ledger brand and is categorized as a crypto scam. The creation date of the domain is 21 February 2026, less than five months before the report date, suggesting a short‑lived campaign.

Because the site is already offline, immediate traffic mitigation is not required, but the IP address 172.66.46.212 remains part of Cloudflare’s shared infrastructure and may host other malicious assets. Defenders should add the domain to internal blocklists, monitor for any resurrection or reuse of the same sub‑domain pattern, and consider extending detection rules to flag any future pages.dev sub‑domains that reference Ledger or exhibit similar TLS and HTTP characteristics. Continuous monitoring of Cloudflare‑hosted domains and periodic re‑scans with VirusTotal or similar engines are advisable to capture potential re‑activations.