learn-start-ledgrr[.]pages[.]dev

The domain learn-start-ledgrr.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.80, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that the content is blocked or inaccessible. Technical fingerprints show the use of Cloudflare services, HTTP/3, and HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid SSL chain but not providing any assurance about the underlying content.

Nameserver records point to elisabeth.ns.cloudflare.com and algin.ns.cloudflare.com, both Cloudflare‑controlled resolvers. The domain is flagged by six of ninety‑three VirusTotal scanners, and it appears on a single external security blocklist. Additional reputation data include a Gridinsoft trust score of 0 / 100 and a block entry from PhishDestroy, confirming that security tooling has identified the site as malicious. The intelligence explicitly links the domain to a Ledger impersonation and classifies the activity as a crypto‑related scam, although no further details about the payload or credential‑harvesting mechanisms are available.

The site is currently taken offline, limiting immediate exposure, but the infrastructure—shared Cloudflare IP space and generic Cloudflare nameservers—may be reused for future campaigns. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the same host or sub‑domain patterns, and add the IP address 172.66.44.80 to threat‑intel feeds despite its legitimate Cloudflare ownership, noting that abuse can originate from any Cloudflare‑hosted service. Continuous review of VirusTotal and other sandbox detections is advised to capture any new payloads should the site become active again.