nano-legerus-en[.]pages[.]dev

This domain, nano-legerus-en.pages.dev, is flagged as an active brand impersonation threat targeting Ledger, a hardware wallet provider. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and is currently resolving to the IP address 172.66.44.111, associated with Cloudflare’s network in Canada. The domain is served over HTTP/3 with HSTS enabled, and its SSL certificate is issued by Google Trust Services (WE1), consistent with Cloudflare’s standard configuration. The page title, 'How to Use Ledger Hardware Wallet | Step-by-Step Guide,' explicitly aligns with Ledger’s branding, reinforcing the impersonation intent. The domain appears on one security blocklist (PhishDestroy) and is flagged by 11 of 91 security vendors in a recent scan, indicating detection by multiple engines. Despite its recent registration, the domain exhibits no overt technical anomalies in its infrastructure, relying on Cloudflare’s hosting and DNS services (nameservers jake.ns.cloudflare.com and ryleigh.ns.cloudflare.com). The HTTP 200 status confirms the site is actively serving content, though the exact nature of the payload—whether credential harvesting, malware distribution, or fraudulent transaction prompts—remains unconfirmed without further analysis. Defenders should prioritize this domain for blocking at the network and endpoint levels, given its confirmed impersonation of a cryptocurrency security brand and active malicious classification. Monitoring for related domains using similar naming patterns (e.g., 'legerus,' 'ledger-support') or shared infrastructure (Cloudflare Pages, Google Trust Services certificates) may help identify additional threats. No evidence suggests this is part of a broader campaign, but the domain’s persistence and clear targeting of Ledger users warrant immediate mitigation.