help-io-ledger-en[.]pages[.]dev

On July 29, 2026 the domain help-io-ledger-en.pages.dev was observed as part of an active brand‑impersonation campaign targeting Ledger. The domain was registered through Cloudflare, Inc. on March 28, 2026 and resolves to the IP address 172.66.46.216, which is hosted on Cloudflare’s network and served by the authoritative name servers guss.ns.cloudflare.com and walk.ns.cloudflare.com. The domain appears on one public security blocklist and has been flagged by the PhishDestroy mitigation service, indicating that it is already being intercepted by at least one upstream filter. VirusTotal scans show that 12 out of 91 antiviruses label the domain as malicious, reinforcing the suspicion that the site is being used for illicit purposes.

The short lifespan of the domain, being less than four months old, aligns with typical fast‑flux phishing infrastructure that relies on disposable domains to avoid long‑term attribution. The use of Cloudflare’s free DNS service also provides the operators with a degree of anonymity and rapid deployment capabilities. No additional metadata such as SSL certificate details, HTTP response codes, or page titles were provided, so the exact page content and the tactics employed by the actors remain unconfirmed. Nevertheless, the convergence of recent registration, Cloudflare‑based hosting, blocklist inclusion, and multi‑vendor detection strongly suggests a deliberate attempt to lure Ledger users into revealing credentials or installing unwanted software.

Defenders should add the fully qualified domain name and its resolving IP address to network‑level deny lists, monitor DNS queries for the associated Cloudflare name servers, and ensure that any corporate or personal Ledger authentication flows are protected by multi‑factor authentication and domain‑whitelisting where feasible. Continuous re‑scanning of the domain on VirusTotal and other telemetry feeds is recommended to capture any changes in the threat posture.