ledgrecom--edge-en[.]pages[.]dev

The domain ledgrecom--edge-en.pages.dev was observed on July 12, 2026 and is currently classified as a high‑risk, active brand‑impersonation campaign targeting Ledger. The site returns HTTP 200 and is listed as blocked by PhishDestroy, indicating that defensive feeds have already identified it as malicious. Infrastructure analysis shows the domain was registered on April 19 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.199, which is attributed to Cloudflare’s network in Canada. The authoritative nameservers are treasure.ns.cloudflare.com and uriah.ns.cloudflare.com, both owned by Cloudflare. The service presents HSTS, uses HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS termination despite the malicious purpose. Threat indicators include a page title of “Ledger Start | Secure Cryptocurrency Onboarding,” directly referencing the Ledger brand and confirming the impersonation intent. The domain appears on a single security blocklist, has a Gridinsoft trust score of 0 out of 100, and VirusTotal reports three positive detections out of 95 scanned vendors, reinforcing the malicious assessment. No additional payloads or download vectors are visible in the available intelligence, and the exact content of the landing page has not been captured. Defenders should immediately block the domain and its resolved IP at perimeter and DNS layers, and add the associated nameservers to any outbound filtering rules that target Cloudflare‑hosted malicious infrastructure. Continuous monitoring of Cloudflare‑registered domains that reference Ledger or similar cryptocurrency onboarding terminology is advised, as the rapid creation date suggests a short‑lived campaign. Updating threat‑intel feeds with the observed indicators—page title, SSL issuer, and VirusTotal positives—will improve detection across endpoint and network sensors.