learn-ledggr-log[.]pages[.]dev

Analysis of learn-ledggr-log.pages.dev shows a newly created site (registered 28 March 2026) hosted on Cloudflare Pages and served over TLS with a Google Trust Services / WE1 certificate. The domain resolves to IP 172.66.44.194, an address owned by Cloudflare, Inc. in Canada, and returns HTTP 200 for the root request. The observed page title is “Ledger Start — Official Getting Started Guide,” indicating an attempt to mimic official Ledger onboarding material. Intelligence attributes the campaign to a Seed Phrase Phishing kit and classifies it as a brand impersonation targeting the Ledger brand. VirusTotal scans have recorded detections by 10 of 94 security vendors, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on one external blocklist and has been actively blocked by PhishDestroy, confirming its operational status. Current confidence in the attribution is high, though the exact page content has not been publicly disclosed. Defenders should block the domain at the network perimeter, update URL filtering rules, and monitor for related indicators such as the associated IP and TLS certificate fingerprint. Continuous observation is advised to detect any evolution of the campaign.