allchain-dappresolution[.]org

This domain was observed on 24 July 2026 as part of a brand‑impersonation campaign targeting Ledger users. The site presented the page title “Decentralized Dapps – We are unifying Web3 by providing best‑in‑class, self‑custodial, and multichain support,” a phrasing commonly used in legitimate Web3 services but unrelated to Ledger’s product line. The underlying infrastructure is hosted behind Cloudflare; DNS resolves to 172.67.169.22, an address owned by AS13335 Cloudflare, Inc. in the United States. Both authoritative nameservers are Cloudflare‑provided (adele.ns.cloudflare.com and darwin.ns.cloudflare.com), and the domain registration record lists Cloudflare, Inc. as the registrar.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS chain but offering no assurance about the site’s intent. An HTTP request returned a 403 status code before the site was taken offline, suggesting that the content was being actively blocked or that the server was configured to reject unauthorised requests. VirusTotal analysis shows that eight of ninety‑three scanning engines flagged the domain, and five independent blocklists have already listed it. Additional telemetry from PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura confirms the detection of a fake‑airdrop scheme.

The domain was created on 21 February 2026, indicating a relatively recent registration typical of fast‑flux phishing operations. Defenders should add 172.67.169.22 and allchain-dappresolution.org to deny‑list rules across perimeter and endpoint controls, enforce TLS inspection to capture any residual traffic, and monitor for similar Cloudflare‑hosted domains that use Ledger‑related branding. Continuous review of blocklist updates is advised, as the infrastructure may be reused for future impersonation attempts. Users should be warned that any unsolicited Ledger airdrop offers are unverified and likely malicious.