ledger-login-ansh[.]pages[.]dev

This domain, ledger-login-ansh.pages.dev, was registered on 2026-02-21 through Cloudflare, Inc. and resolves to the Cloudflare-owned address 172.66.44.168, announced as belonging to ASN 13335 (Cloudflare, Inc.) with a United States location. The domain employs Cloudflare’s DNS infrastructure, using the nameservers davina.ns.cloudflare.com and damiete.ns.cloudflare.com, and presents an HTTPS certificate issued by Google Trust Services under the WE1 series. The presence of HSTS and support for HTTP/3 are consistent with Cloudflare-hosted services. An HTTP request to the site returns a 403 status code and the page title “Suspected phishing site | Cloudflare”, which is the default block page Cloudflare serves when a domain is flagged for abuse.

VirusTotal analysis shows that 11 of 93 scanned security vendors have marked the domain as malicious, and the site is listed on the PhishDestroy blocklist. Independent scoring from Gridinsoft assigns a trust rating of 0 out of 100, reinforcing the malicious assessment. The site is attributed to a “Crypto Scam” and specifically impersonates the Ledger brand, indicating that it is likely intended to capture cryptocurrency-related credentials.

Given the combination of recent registration, Cloudflare infrastructure, low trust score, multiple vendor detections, and blocklist inclusion, the domain should be treated as malicious. Defenders are advised to block the domain at network perimeter, add it to internal URL filtering policies, and monitor for any related indicators such as connections to the 172.66.44.168 IP address or use of the same Cloudflare nameservers. Since the site is currently offline, continuous re-evaluation is recommended in case the operators reactivate the domain.