ledgerverify[.]app

The domain ledgerverify.app was registered on 23 February 2026 through NiceNIC International Group Co., Limited. Its authoritative name servers are gabriel.ns.cloudflare.com and ulla.ns.cloudflare.com, indicating it is hosted behind Cloudflare's network. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, confirming that HTTPS is properly terminated but offering no indication of malicious intent beyond the fact that the certificate is publicly trusted. The page title returned by the HTTP response is the French phrase “Un instant…”. The server responds with HTTP status code 403, suggesting that direct content retrieval is blocked, which is a common tactic to hinder automated analysis.

Threat intelligence flags the domain as a crypto‑related impersonation of the Ledger brand. VirusTotal has recorded 3 positive detections out of 93 scanned engines, and the domain is listed on at least one public blocklist, including PhishDestroy. These independent signals raise the risk rating to high. Evidence indicates the site is active as of the report date (25 July 2026). The combination of a recent registration, Cloudflare front‑end, valid SSL, and a 403 response aligns with typical infrastructure used by credential‑stealing or crypto‑drain campaigns that rely on brand impersonation to lure victims. Uncertainty remains regarding the actual payload delivered to end users because the HTTP 403 response prevents content inspection, and no screenshots or HTML snapshots have been captured.

No additional indicators such as malicious JavaScript hashes, command‑and‑control URLs, or known phishing kits have been observed. Defenders should block ledgerverify.app at the DNS or proxy level, add it to URL filtering policies, and monitor for outbound connections to the IP 188.114.96.3.