leedger-star-io[.]pages[.]dev

On 24 March 2026 the domain leedger-star-io.pages.dev was registered through Cloudflare, Inc. The name resolves to the Cloudflare edge address 172.66.47.155, which is geolocated to Canada and is associated with the Cloudflare network. The site served an HTTP 403 response and presented the page title “Ledger Start | Official Hardware Wallet Setup Guide”, indicating a direct attempt to mimic Ledger’s official onboarding experience. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid TLS chain but offering no indication of legitimate ownership. Passive analysis recorded the presence of HTTP Strict Transport Security, HTTP/3, and Cloudflare‑provided security headers, all typical of Cloudflare‑hosted content. Reputation services have flagged the domain.

It appears on one security blocklist and received a Gridinsoft trust score of 0 / 100. PhishDestroy has actively blocked the domain. VirusTotal scans show nine of ninety‑four antivirus engines flagging the domain as malicious. No additional intelligence such as OTX references or known malware kits is available.

The page content itself has not been captured, leaving the exact phishing landing page unknown. Given the observed indicators, the domain should be treated as a high‑confidence Ledger brand impersonation. Defensive teams are advised to add the fully qualified domain name to URL filtering and DNS blocklists, monitor for future resolution changes, and enforce TLS inspection policies to detect any credential‑harvesting forms that may appear if the site is re‑hosted. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is also recommended.