# PhishDestroy domain threat record: ledger-3x4.pages.dev Content language: English Canonical HTML report: https://phishdestroy.io/domain/ledger-3x4.pages.dev/ Machine-readable companion: https://phishdestroy.io/domain/ledger-3x4.pages.dev/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 19:21:17 UTC - Last availability or vendor check: 2026-10-22 23:06:39 UTC - Stored record updated: 2026-10-22 23:06:39 UTC - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Ledger ## Stored infrastructure - Observed IP address: 172.66.47.198 - Registrar in stored WHOIS data: Cloudflare, Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, pages.dev): 2020-09-02 02:33:29 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1650e-469b-712c-a7bd-cdc91ddd163f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ledger-3x4.pages.dev - Certificate Transparency search: https://crt.sh/?q=%25.ledger-3x4.pages.dev - Web Archive lookup: https://web.archive.org/web/*/https://ledger-3x4.pages.dev/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/GffW3QGV/e9d0abfb794c.png Captured: 2026-10-22 19:21:17 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1650e-469b-712c-a7bd-cdc91ddd163f.png Captured: 2026-10-22 19:21:17 UTC Source report: https://urlscan.io/result/01a1650e-469b-712c-a7bd-cdc91ddd163f/ - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a794-a9d6-74c0-b64d-0fb6e6163a17.png Captured: 2026-09-16 00:18:58 UTC Source report: https://urlscan.io/result/01a0a794-a9d6-74c0-b64d-0fb6e6163a17/ SHA-256: 02f918a4894391b077421546321b4e3e0394b7dffbf3d6271e740c7a3372f405 - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a794-a7da-7059-ab01-dce37e6c9298.png Captured: 2026-09-16 00:18:58 UTC Source report: https://urlscan.io/result/01a0a794-a7da-7059-ab01-dce37e6c9298/ SHA-256: 7a5c2133bb7c919ce1f3c61fe657963cf9a0e5dc06f64e276589ed9c94edf98c - URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de54-a366-769a-acda-1df4293e80fb.png Captured: 2026-09-26 15:28:13 UTC Source report: https://urlscan.io/result/01a0de54-a366-769a-acda-1df4293e80fb/ SHA-256: c6541851fe4e867d0a0edcbf66b57211707d973c11d6106ef662d99c81ddc920 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T20:17:00Z", "uuid": "01a1650e-469b-712c-a7bd-cdc91ddd163f", "scanned_at": "2026-10-22T19:20:07Z", "final_url": "https://ledger-3x4.pages.dev/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ledger-3x4.pages.dev/", "from": "http://ledger-3x4.pages.dev/", "status": 307 } ], "ip": "172.66.47.198", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "192.178.183.94", "142.251.14.95", "172.66.47.198" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "37e3986bd5aea4cce9ceb629db62196a069b7411eb656a60a77ef7b7c5242345", "script_hashes": [ "be632469e456fdfeafa01919f76999abeabab88abd42a9e44397eeab110802a4" ], "globals": [ "uRx", "dayHours", "T", "goalTabsShown", "loadRoster", "saveRoster", "dataKey", "slotRead", "slotOf", "curDataKey", "syncFieldSync", "dateFmt", "dateShow", "dateParse", "isoOf", "ymOf", "daysBetween", "addDays", "closeTaskZoom", "tzRender", "tzWire", "openTaskZoom", "setSyncState", "diagnose", "noteFail", "encIs", "encOk", "b64e", "b64d", "encHex", "encSaltFor", "encAdoptSalt", "encKey", "encSeal", "encOpen", "waitForWriteSlot", "releaseWriteSlot", "stampSave", "savedAtOf", "whenWord" ], "storage_keys": [ "ledger:signed", "ledger:roster", "ledger:v1:u1" ], "tls": { "san": [ "ledger-3x4.pages.dev", "*.ledger-3x4.pages.dev" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "ledger-3x4.pages.dev", "protocol": "TLS 1.3", "valid_to": "2026-11-24T20:22:08Z", "valid_from": "2026-08-26T19:24:50Z" }, "domain_age_days": 56, "apex_age_days": 56, "tls_age_days": 56, "tls_valid_days": 90, "requests": 12, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "ledger" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Ledger" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "vt": { "v": 1, "fetched_at": "2026-10-22T20:40:00Z", "analysis_at": "2026-10-22T20:01:43Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 3, "suspicious": 0, "undetected": 34 }, "detections": { "Fortinet": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "CloudFlare, Inc.", "created": "2020-09-02T02:33:29Z", "expires": "2026-09-02T02:33:29Z", "updated": "2025-03-17T14:56:22Z", "first_seen": "2026-08-26T20:50:33Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.66.47.198" }, { "ttl": 21600, "type": "NS", "value": "vicente.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.66.44.58" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2c3a" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:310c::ac42:2fc6" }, { "ttl": 21600, "type": "NS", "value": "savanna.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "savanna.ns.cloudflare.com" } ], "dns_at": "2026-10-22T20:07:05Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "ledger-3x4.pages.dev", "*.ledger-3x4.pages.dev" ], "issuer": "Google Trust Services / WE1", "serial": "cb26b18c26f4ee060efa93bce04db06c", "sha256": "ee02e376fd22347cb7ad82ab55a16d116d2069e70358d2034ac3a73971126218", "subject": "ledger-3x4.pages.dev", "valid_to": "2026-11-24T20:22:08Z", "valid_from": "2026-08-26T19:24:50Z" }, "whois": { "registrar": "CloudFlare, Inc.", "registrar_iana_id": "1910", "registrar_url": "None", "created": "2020-09-02T02:33:29Z", "updated": "2023-09-04T18:15:07Z", "expires": "2026-09-02T02:33:29Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "nameservers": [ "adi.ns.cloudflare.com", "karl.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```