folio-ledger-hardware-wallet[.]pages[.]dev

The domain folio-ledger-hardware-wallet.pages.dev is currently active and hosts a page titled “Hardware Wallet & Crypto Wallet - Security for Crypto | Ledger.” The page title explicitly references the Ledger brand, indicating a brand‑impersonation campaign aimed at credential harvesting or malware distribution. The domain was registered on 20 August 2025 and resolves to the IP address 172.66.46.225, which is part of Cloudflare’s AS13335 network in the United States. DNS resolution uses the Cloudflare nameservers brad.ns.cloudflare.com and jade.ns.cloudflare.com, and the site serves over HTTPS with a certificate issued by Google Trust Services under the WE1 trust model. HTTP responses return status 200 and the server advertises HSTS and HTTP/3, confirming modern security configurations that may aid in evading simple network‑level blocks. Threat intelligence feeds report that 12 of 91 VirusTotal scanners flag the domain, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single security blocklist and has been blocked by PhishDestroy. While the presence of brand‑specific page titles and the use of a reputable CDN suggest a deliberate attempt to lend credibility, the actual malicious payload or credential‑capture mechanism has not been publicly disclosed. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and update email security policies to flag any communications that reference the Ledger brand with suspicious URLs. Continuous scanning of the domain for malware or phishing content is recommended, as the infrastructure remains live and could evolve its payload delivery methods.