ledger-fola[.]pages[.]dev

The domain ledger-fola.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare's network, resolving to IP address 104.21.64.1, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presented a page title of "Trade" and is classified as a crypto scam that impersonates the Ledger brand. Technical inspection shows the domain uses Cloudflare services, with HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 label. An HTTP 403 response was observed, indicating that the resource is currently inaccessible.

The Gridinsoft trust score for the domain is 0 out of 100, reflecting a high confidence in malicious intent. Reputation data lists the domain on two security blocklists, PhishDestroy and ScamSniffer, confirming its identification as a malicious resource. VirusTotal analysis recorded 10 detections out of 93 security vendors, reinforcing the suspicion of fraudulent activity.

The domain is presently offline, and the risk level has been assigned as elevated. Defenders encountering this indicator should block the domain at perimeter defenses, update URL filtering rules to include the listed blocklists, and monitor for any related C2 infrastructure that may reuse the same Cloudflare IP range. Continuous observation of Cloudflare‑hosted IPs associated with Ledger‑related impersonation campaigns is advised, as threat actors often recycle infrastructure to support new impersonation attempts.