doc-ledge-start-now[.]pages[.]dev

doc-ledge-start-now.pages.dev is an active domain registered on April 30, 2026 through Cloudflare, Inc. The domain resolves to 172.66.47.49, a Cloudflare‑owned address located in Canada. Nameservers dina.ns.cloudflare.com and trey.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The site serves content over HTTPS with a Google Trust Services certificate and enforces HSTS, while also supporting HTTP/3, indicating a modern web stack. The page title returned by the server is “Ledger & Crypto Security”, and the brand target is explicitly listed as Ledger, classifying the activity as brand impersonation. The domain appears on one security blocklist and is listed by PhishDestroy as malicious. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 7 of 91 scanners flagging the domain, reinforcing the suspicion. No additional technical artifacts such as malicious payloads or credential‑harvesting forms have been observed in the provided data. Given the high risk rating, defenders should block DNS resolution for doc-ledge-start-now.pages.dev, monitor outbound connections to its IP address, and add the domain to web‑filter deny lists. Continuous scanning for any changes in content or additional infrastructure should be performed, as the current evidence does not reveal the exact phishing page layout or payload.