start-ldgerr--en[.]pages[.]dev

The domain start-ldgerr--en.pages.dev is currently active and hosts a page titled “Get Started with Ledger — Presentation”. Analysis identifies the site as a brand‑impersonation campaign targeting Ledger, employing a seed‑phrase phishing kit. The site resolves to the Cloudflare‑owned address 172.66.47.156, located in Canada, and is served through Cloudflare’s DNS infrastructure (cortney.ns.cloudflare.com, kipp.ns.cloudflare.com). SSL is provided by Google Trust Services under the WE1 certificate, and the HTTP response returns status 200. Reputation metrics are poor, with a Gridinsoft trust score of 0/100 and inclusion on a single security blocklist. PhishDestroy has already blocked the domain. VirusTotal records show that one of ninety‑four scanning engines flagged the domain, indicating at least partial detection of malicious characteristics. Given the confirmed impersonation of Ledger and the use of a known seed‑phrase phishing template, defenders should add the domain and its IP address to deny‑list rules, monitor for related DNS queries, and enforce strict outbound filtering for traffic to Cloudflare‑hosted IPs that are not otherwise authorized. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.