verifyuledger[.]com

This domain, verifyuledger.com, is flagged as an active brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Registered on April 14, 2026, through Dynadot Inc, the domain currently resolves to 188.114.96.3, an IP address associated with CloudFlare, Inc. in Canada. Infrastructure analysis reveals CloudFlare nameservers (brodie.ns.cloudflare.com and paris.ns.cloudflare.com) and a single MX record pointing to _dc-mx.469417e76c26.verifyuledger.com with a priority of 10, suggesting potential email-based attack vectors. The domain is blocked by PhishDestroy and carries a Gridinsoft trust score of 0/100. Two of 94 security vendors on VirusTotal have flagged this domain, and it appears on one security blocklist. AlienVault OTX has recorded it in a threat intelligence pulse, indicating prior detection in threat-sharing communities. The SSL certificate is issued by Google Trust Services (WE1), a common but not inherently suspicious provider. At the time of assessment, the domain returns an HTTP 403 status with the page title 'Just a moment...', which may indicate a CloudFlare challenge page or a temporary block. No further content analysis is available, so the exact nature of the phishing kit or attack chain remains unconfirmed. Defenders should treat this domain as high-risk and block it at the DNS, proxy, or firewall level. Monitoring for related subdomains or MX record changes is recommended, as these may signal evolving attack infrastructure.