ledgr-eu-ledgr[.]pages[.]dev

Analysis of ledgr-eu-ledgr.pages.dev indicates an active brand-impersonation campaign targeting Ledger users. The domain resolves to 172.66.44.197, an address owned by Cloudflare (AS13335) located in the United States. DNS is served by the Cloudflare authoritative nameservers benedict.ns.cloudflare.com and jill.ns.cloudflare.com, confirming that the infrastructure is hosted entirely within the Cloudflare network. The site presents a page title “Getting Started with Ledger: The Official Hub for Hardware Wallet Setup and Secure Crypto Management”, which directly references the Ledger brand and aligns with the recorded scam type of brand impersonation. The HTTP response returns status code 403, indicating that the server is currently refusing to serve content, and the domain is listed as offline in the current intelligence feed.

Despite the offline status, the domain has been added to at least one security blocklist and is flagged by PhishDestroy. VirusTotal scans show that three out of ninety-one security vendors flagged the domain, reinforcing the suspicion of malicious intent. Additional reputation data includes a Gridinsoft trust score of 0 / 100, suggesting a high likelihood of abuse. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, which is a common certificate chain for Cloudflare‑proxied sites and does not, by itself, indicate legitimacy.

No further artifacts such as login forms or malicious payloads have been disclosed, so the exact content of the impersonation page remains unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation attempts, and add the IP address 172.66.44.197 to blocklists where appropriate. Because the domain is hosted on a shared Cloudflare infrastructure, any future sub‑domain creation using the same nameservers may exhibit similar characteristics; therefore, threat‑intel feeds should be consulted for emerging indicators.