leadger-com-sart-inst[.]pages[.]dev

The domain leadger-com-sart-inst.pages.dev was registered on April 30, 2026 and is currently active. It resolves to Cloudflare IP 188.114.97.3 located in Canada and is served through Cloudflare infrastructure with HSTS and HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS connection. The site returns HTTP 200 and displays the page title "How to Set up Ledger Portfolio & Wallet App — Official Guide," which directly references the Ledger brand, matching the listed brand impersonation threat type. The domain is listed on a single security blocklist and is blocked by PhishDestroy. VirusTotal analysis shows 11 of 91 security vendors flag the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. Nameservers carol.ns.cloudflare.com and dean.ns.cloudflare.com confirm registration through Cloudflare. While the exact content of the page has not been inspected, the combination of brand‑targeted title, high‑risk classification, and multiple security detections strongly suggests a credential‑harvesting or fraud operation aimed at Ledger users. Defenders should block the domain at perimeter controls, monitor DNS queries for the domain and its associated IP, and update URL filtering rules to include this indicator. Incident response teams should treat any traffic to this host as suspicious and advise users to avoid interacting with the site or providing Ledger‑related credentials.