edger-com-start[.]pages[.]dev

edger-com-start.pages.dev is currently active and classified as a high‑risk brand‑impersonation campaign targeting Ledger. The site was registered on 30 April 2026 and resolves to the Cloudflare‑owned address 172.66.47.172 located in Canada. DNS is served by nile.ns.cloudflare.com and sandra.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 identifier, and the server advertises HSTS and HTTP/3. HTTP requests return status 200. Infrastructure analysis shows the domain is hosted behind Cloudflare’s edge network, a common tactic for fast‑flux or hide‑behind services. The page title “Ledger Start — Secure your crypto: onboarding animation brief & content” explicitly references the Ledger brand, confirming the impersonation intent. Reputation data shows a Gridinsoft trust score of 0/100 and the domain appears on a single security blocklist, currently blocked by PhishDestroy. VirusTotal scans report 13 of 91 vendors flagging the domain as malicious. Given the high risk rating, defenders should add the domain to deny‑list rules, monitor DNS queries for the associated IP, and ensure any inbound traffic to the host is inspected. Continuous re‑evaluation is advised as threat actors may modify the payload or hosting configuration.