feq-start-ledgr-cloud[.]pages[.]dev

The domain feq-start-ledgr-cloud.pages.dev was registered through Cloudflare, Inc. on April 30, 2026 and resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to CA. Authoritative nameservers arvind.ns.cloudflare.com and donna.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The site presents the page title "Ledger Start — Secure your crypto in minutes | Ledger.com," directly referencing the Ledger brand, and the listed scam type is brand impersonation. Technical fingerprints show HSTS enforcement, HTTP/3 support, and an SSL certificate issued by Google Trust Services (WE1). Reputation data indicate a Gridinsoft trust score of 0/100 and that two of ninety‑one VirusTotal scanners have flagged the domain. The domain is currently listed on a single security blocklist and has been blocked by PhishDestroy, yet it remains active. Observed evidence points to a high‑risk impersonation campaign targeting Ledger users. Defenders should add the domain to URL filtering and DNS blocklists, monitor for similar Cloudflare‑hosted subdomains, and consider raising alerts for any traffic matching the observed page title. Further content analysis is required to determine the exact payload or credential‑capture mechanisms employed.