ask-ldgr-bridge[.]pages[.]dev

The domain ask-ldgr-bridge.pages.dev was registered on March 22, 2026 through Cloudflare, Inc. The site presents the page title “Ledger ™ Bridge | Getting started with Ledger” and claims to be associated with Ledger, indicating a targeted brand impersonation campaign. The hosting resolves to the IP address 172.66.47.200, which belongs to Cloudflare, Inc. in Canada, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of legitimate certificate infrastructure. HTTP responses return a 403 status, and the service is protected by HSTS, HTTP/3, and Cloudflare’s edge network. Security analysis on VirusTotal shows that 8 of 94 scanning engines flagged the domain, and the domain appears on a single external blocklist.

The site is currently offline and has been taken down by the PhishDestroy mitigation service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Nameserver records list cash.ns.cloudflare.com and olivia.ns.cloudflare.com, consistent with the registrar. The campaign is categorized as a crypto scam, targeting Ledger users to potentially harvest credentials or funds.

At present, no additional infrastructure such as command‑and‑control servers or downloader kits has been observed, and the page content beyond the title has not been publicly disclosed. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for similar sub‑domains under the pages.dev namespace, and update detection rules to incorporate the observed TLS fingerprint and HTTP status pattern. Ongoing threat‑intel sharing with blocklist operators is recommended to ensure rapid propagation of the indicator set.