strt-ledger-com-ent[.]pages[.]dev

strt-ledger-com-ent.pages.dev is a newly registered sub‑domain (created 04 Apr 2026) that hosts a page titled “Ledger Start Guide — Secure Setup for Your Device”. The site is served through Cloudflare Pages, as evidenced by registration via Cloudflare, Inc., nameservers rosemary.ns.cloudflare.com and toby.ns.cloudflare.com, and resolution to the Cloudflare edge IP 188.114.97.3 located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. The domain is classified as a brand‑impersonation campaign targeting Ledger, and the page title suggests an attempt to lure users into a device‑setup workflow. Threat intelligence flags the domain as high‑risk and active; it is listed on one security blocklist and has been blocked by PhishDestroy. Reputation metrics are poor, with a Gridinsoft trust score of 0/100 and five of ninety‑four VirusTotal scanners flagging the host. No additional payload or credential‑harvesting details have been publicly disclosed, so the exact malicious behavior remains uncertain. Defenders should add the domain to URL filtering, DNS blocklists, and email security policies, monitor for related C2 traffic from the Cloudflare IP range, and consider sinkholing the sub‑domain to disrupt potential phishing campaigns. Continuous observation of any changes to the page content or certificate metadata is recommended.