guide-legor-start-x[.]pages[.]dev

The domain guide-legor-start-x.pages.dev is currently active and has been identified as a brand‑impersonation site targeting Ledger users. The site resolves to the Cloudflare‑managed IP address 188.114.97.3, which is geolocated to Canada and is served from Cloudflare, Inc. Infrastructure analysis shows the domain was created on 10 April 2026 and is registered through Cloudflare, Inc. Its authoritative nameservers are david.ns.cloudflare.com and priscilla.ns.cloudflare.com. The site presents the page title "Ledger.com Start - Secure Your Crypto Journey," directly referencing the Ledger brand. TLS is provided by Google Trust Services under the WE1 certificate, indicating a valid HTTPS connection despite the malicious intent. Reputation scoring is extremely low, with a Gridinsoft trust score of 0 / 100, and the domain appears on one security blocklist. VirusTotal scans report three detections out of ninety‑four vendors, reinforcing the malicious classification. The domain has been blocked by PhishDestroy, confirming active mitigation efforts. While the specific content of the page has not been examined, the combination of brand‑impersonation metadata, low trust score, multiple vendor detections, and blocklist presence suggests a high‑risk threat to Ledger customers. Defenders should add the domain to deny‑list policies, monitor DNS queries for the associated IP and nameservers, and educate users to avoid entering Ledger credentials on any site matching this title or domain. Ongoing observation is recommended to detect any changes in hosting or content.