doc--ledge-start-ccnd[.]pages[.]dev

The domain doc--ledge-start-ccnd.pages.dev was registered on April 30, 2026 through Cloudflare, Inc. and is currently active. DNS resolution points to IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada and is served behind Cloudflare’s edge network using HSTS, HTTP/3, and a Google Trust Services / WE1 SSL certificate. The site returns HTTP 200 and presents the page title "Ledger: Bitcoin & Crypto Security," indicating a brand‑impersonation attempt targeting Ledger. Independent analysis by Gridinsoft assigns a trust score of 0/100, and two of ninety‑one VirusTotal scanners have flagged the domain as malicious. The domain appears on one known security blocklist and is blocked by PhishDestroy. The infrastructure—Cloudflare‑provided nameservers amy.ns.cloudflare.com and toby.ns.cloudflare.com—suggests the operators rely on legitimate hosting services to obscure provenance. While the exact payload or credential‑ harvesting mechanism has not been publicly disclosed, the combination of a high‑risk classification, low trust score, and detection by multiple security vendors warrants precaution. Defenders should block or sinkhole the domain, monitor DNS queries for the associated IP, and alert users that any unsolicited request for Ledger credentials originating from this host is likely fraudulent.