ledger-grid-internal-docs[.]pages[.]dev

This domain is flagged as an active brand impersonation threat targeting the Across platform. Analysis indicates a high-risk scenario due to its recent creation and deceptive infrastructure, despite minimal detection at this stage. The domain operates under the guise of legitimate documentation or internal resources, a common tactic in crypto-related credential theft or asset diversion schemes. Infrastructure analysis reveals the domain resolves to IP 188.114.97.3, hosted on Cloudflare, Inc. infrastructure (AS13335). It was registered on September 08, 2025, through Cloudflare, Inc., and presents a page title of LedgerGr.id. VirusTotal reports 0/95 detections, indicating no prior flagging by security vendors. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), and the IP geolocation is listed as US. Mitigation steps specific to this brand impersonation threat include immediate blocking of the domain and associated IP at the network perimeter. Security teams should monitor for internal traffic to ledger-grid-internal-docs.pages.dev or connections to 188.114.97.3. Endpoint detection rules should be updated to flag any process attempting to access this domain or resolve its IP. Given the crypto-focused nature of the target, users should be advised to verify all transaction requests via secondary, trusted channels and avoid interacting with any communications or prompts originating from this domain. Organizations should also review recent outbound connections to Cloudflare-hosted IPs for anomalous patterns.