ledger-com-start-c5m[.]pages[.]dev

Analysis of ledger-com-start-c5m.pages.dev indicates a cryptocurrency phishing operation impersonating Ledger, a hardware wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., currently resolves to IP 172.66.45.29 (US, AS13335 Cloudflare, Inc.) and is served via Cloudflare’s infrastructure, including nameservers sandra.ns.cloudflare.com and vick.ns.cloudflare.com. The site was flagged by 11 of 93 security vendors on VirusTotal, though this does not represent a full consensus. Additional trust assessments from Scamadviser and Gridinsoft both assign a score of 1/100 and 0/100, respectively, classifying it as a crypto scam.

The domain is listed on at least one security blocklist and was blocked by PhishDestroy prior to being taken offline. The HTTP status returned is 403 (Forbidden), and the page title displayed is 'Suspected phishing site | Cloudflare,' suggesting Cloudflare’s automated systems may have intervened. The domain employs HSTS and HTTP/3, typical of modern web infrastructure, and uses an SSL certificate issued by Google Trust Services (WE1). While the exact phishing kit or lure remains unconfirmed, the available evidence—including the domain structure, brand impersonation, and scam classification—strongly aligns with crypto wallet credential theft or fraudulent token transfers.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Given its association with Cloudflare Pages and the use of Cloudflare’s CDN, monitoring for newly created subdomains under pages.dev with similar naming patterns may help identify related threats. The domain’s current offline status does not preclude future reactivation, and historical reputation checks should be maintained for at least 12 months.