nu-ledgers[.]pages[.]dev

On July 23, 2026, analysis was performed on nu-ledgers.pages.dev, a domain created on March 22, 2026 and currently taken offline. The domain resolves to the Cloudflare edge address 188.114.97.3, which is geolocated to Canada and is served by Cloudflare, Inc. The authoritative nameservers are gigi.ns.cloudflare.com and joaquin.ns.cloudflare.com, indicating the domain is fully managed through Cloudflare’s DNS platform. TLS termination is provided by a Google Trust Services certificate issued to “WE1”, and the site enforces HSTS while supporting HTTP/3, confirming modern security configurations despite the malicious intent. Content analysis reveals a page title of “Getting Started with Ledger Wallet – Ledger.com/start”, directly referencing the Ledger brand. The domain is classified as a crypto-related brand impersonation campaign targeting Ledger users.

Twelve of ninety-four VirusTotal scanners flagged the domain, and it appears on one public security blocklist. The Gridinsoft trust score of 0 out of 100 further reflects a high confidence of malicious activity. PhishDestroy has actively blocked the domain, and HTTP requests return a 403 status code, suggesting the site is no longer serving content. The available evidence points to a typical phishing infrastructure that leverages Cloudflare’s free tier to obscure the origin of the malicious host while presenting a legitimate‑looking URL under the pages.dev sub‑domain space. The use of a legitimate TLS certificate and modern protocols may increase the likelihood of successful credential harvesting in a crypto‑wallet context.

However, the current offline status limits immediate risk to active users, though the underlying infrastructure could be re‑activated. Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use, add the domain to internal deny lists, and enforce URL filtering for any sub‑domains of pages.dev that reference Ledger.