safe-strt-ledgr[.]pages[.]dev

This domain is flagged as a brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis of domain registration and infrastructure reveals the domain was created on April 27, 2026, and remains active as of July 12, 2026. It is registered through Cloudflare, Inc. and uses Cloudflare nameservers (arely.ns.cloudflare.com and ricardo.ns.cloudflare.com). The domain resolves to IP address 172.66.46.244, which is located in Canada and belongs to Cloudflare, Inc. The page title observed is "Ledger Start | Secure Crypto Setup," consistent with a Ledger-branded setup page. VirusTotal scanning shows 14 out of 91 security vendors flagging this domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1). The HTTP status is 200, indicating the site is live and serving content. The Gridinsoft trust score is 0 out of 100, reflecting high risk. Technologies detected include HSTS, Cloudflare, and HTTP/3. Defenders should block this domain at the network level, add it to blocklists, and monitor for related subdomains or variations. Users should be advised that legitimate Ledger setup pages do not use the pages.dev subdomain. The exact content of the page has not been analyzed, but the combination of brand impersonation indicators and high detection rate strongly suggests a credential harvesting or phishing operation.