com-ledgerr-com[.]pages[.]dev

Analysis of the domain com-ledgerr-com.pages.dev, observed on July 25 2026, shows a high‑confidence Ledger impersonation used for a crypto‑related scam. The domain was registered on February 21 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.64 located in the United States under ASN 13335. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint, while the server advertises HSTS and HTTP/3, typical of Cloudflare‑protected sites. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, which aligns with the site being taken offline after detection.

Security‑vendor scans on VirusTotal flagged the domain by 13 of 93 scanners, and the site appears on a single external blocklist. Independent monitoring by PhishDestroy has already blocked the domain, and the proprietary Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trust. The evidence points to a brand‑impersonation campaign targeting Ledger users and classified as a crypto scam.

The exact content of the phishing page has not been captured, so the specific technique for credential or payment collection remains uncertain. Defenders should add the domain and its resolved IP address to blocklists, enforce DNS‑level filtering for the .pages.dev subdomain, and monitor for any similar subdomains that use the Cloudflare name servers lorna.ns.cloudflare.com and colin.ns.cloudflare.com. Continued observation of VirusTotal and other sandbox feeds is recommended to detect any re‑hosting attempts, and outbound traffic to the IP should be inspected for malicious payloads or credential exfiltration.