ledger-com-start-8gs[.]pages[.]dev

Analysis of ledger-com-start-8gs.pages.dev indicates a high-risk brand impersonation domain targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare's infrastructure (AS13335) with an IP address of 172.66.46.253 located in the US. As of July 24, 2026, the domain returns an HTTP 403 status and displays a Cloudflare interstitial page titled 'Suspected phishing site,' which aligns with its presence on at least one security blocklist (PhishDestroy) and classification as a crypto scam. Google Safe Browsing flags the domain for social engineering, and Gridinsoft assigns it a trust score of 0/100, while Scamadviser rates it at 10/100.

Twelve out of 93 security vendors on VirusTotal detect the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the domain employs HSTS and HTTP/3 technologies, typical of Cloudflare-hosted properties. Nameservers are collins.ns.cloudflare.com and lennon.ns.cloudflare.com, further confirming Cloudflare as the registrar and hosting provider. While the domain is currently offline, its infrastructure and detection history suggest it was actively used for phishing or fraudulent activity impersonating Ledger.

Defenders should treat this domain as malicious, block access at the network level, and monitor for related subdomains or newly registered lookalike domains under Cloudflare Pages. The exact content of the phishing page is not confirmed, but the available indicators—brand target, scam type, and detection data—support its classification as a crypto-focused threat. No evidence of a phishing kit or additional payloads has been identified in the provided data.