more-ledger-en-faq[.]pages[.]dev

The domain more-ledger-en-faq.pages.dev was registered on May 01, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned IP address 172.66.44.237, served by nameservers conrad.ns.cloudflare.com and ursula.ns.cloudflare.com. The site presents an SSL certificate issued by Google Trust Services (WE1) and enforces HSTS, indicating a legitimate TLS configuration despite the malicious intent. Infrastructure analysis shows the use of Contentful for content delivery, Tailwind CSS for styling, and HTTP/3 support, all typical of modern web stacks hosted on Cloudflare. The page title "Ledger® Hardware Wallet | Official Store for Safe Crypto | Lédger®" directly references the Ledger brand, confirming a brand‑impersonation campaign. VirusTotal scans show eight of ninety‑one security vendors flag the domain, and it is listed on at least one public blocklist, with PhishDestroy already blocking it. Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk classification. The site returns HTTP 200, suggesting the content is actively served. While the exact page content has not been examined, the combination of brand‑specific title, recent registration, Cloudflare hosting, and multiple security detections indicates an active credential‑harvesting operation targeting Ledger customers. Defenders should immediately block the domain at network and endpoint layers, add it to URL filtering policies, and monitor for related traffic. Continuous re‑scanning is advised to capture any changes in payload or hosting configuration.