nav-legdfr[.]pages[.]dev

The domain nav-legdfr.pages.dev was registered on April 5 2026 through Cloudflare, Inc. and currently resolves to the Cloudflare‑owned address 172.66.44.150, hosted in Canada. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating the use of a legitimate certificate chain but not confirming any affiliation with Google. The page title returned by the server is “Ledger Start — Purple Guide to Secure Crypto Onboarding,” which does not reference Google directly. The infrastructure uses the Cloudflare nameservers boyd.ns.cloudflare.com and sarah.ns.cloudflare.com, and the HTTP response code is 200. VirusTotal analysis shows that 6 of 94 security vendors flag the domain, and the Gridinsoft trust score is 0 / 100. The domain is listed on one public blocklist and is actively blocked by PhishDestroy, reflecting its classification as a high‑risk brand‑impersonation campaign targeting Google. While the exact content of the page has not been examined, the combination of a Google‑related SSL certificate, a misleading title, and multiple vendor detections suggests a deliberate attempt to deceive users. Defenders should block the domain at the DNS and proxy layers, monitor for any related C2 traffic, and update detection rules to include the observed indicators of compromise.