support-ledgr-io-web[.]pages[.]dev

The domain support-ledgr-io-web.pages.dev was registered on March 22, 2026 and currently resolves to the IPv4 address 188.114.97.3. The address is owned by Cloudflare, Inc. and is geolocated to Canada. DNS resolution is served by the Cloudflare nameservers archer.ns.cloudflare.com and kinsley.ns.cloudflare.com, and the site is delivered over HTTP/3 with HSTS enforced. The web page presents a title that mimics Ledger’s official documentation: "Ledger.com/Start$ — Official Ledger Wallet Setup Guide". The TLS certificate is issued by Google Trust Services under the WE1 profile, and the HTTPS handshake returns a 200 OK status. Google Safe Browsing tags the URL with the SOCIAL_ENGINEERING category, and VirusTotal reports that 17 of 95 security vendors have flagged the domain as malicious. Threat intelligence classifies the activity as a high‑risk brand‑impersonation campaign targeting Ledger users, with a cryptocurrency‑theft motive. The site’s Gridinsoft trust score is 0 out of 100, and it appears on a single security blocklist that is currently enforced by PhishDestroy. No additional malicious payloads or download links were observed, but the page’s branding and URL structure are designed to lure victims into providing wallet credentials or seed phrases. Uncertainty remains regarding the specific phishing kit or any post‑exploitation infrastructure, as the current evidence is limited to the hosting layer and branding. Monitoring of network traffic to the IP 188.114.97.3 and the associated Cloudflare edge nodes is recommended, alongside blocking of the domain at perimeter firewalls and DNS filtering solutions. Organizations should also educate Ledger users about the legitimate Ledger website URL and warn against unsolicited requests for private keys.