tdfcrrsy[.]pages[.]dev

The domain tdfcrrsy.pages.dev is currently active and hosts a site titled EVERNODE. Infrastructure analysis shows the domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. Registration details indicate the domain was created on August 11, 2023 through Cloudflare, Inc., and it uses the authoritative nameservers arushi.ns.cloudflare.com and clay.ns.cloudflare.com. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 label and supports HSTS, cdnjs, Cloudflare CDN, and HTTP/3. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING, and 11 of 93 VirusTotal scanners have raised detections. The Gridinsoft trust score is 0 out of 100, and the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The known intelligence classifies the activity as a crypto scam impersonating the Ledger brand, assigning a high risk rating. While the page content has not been publicly examined, the combination of brand impersonation, a valid SSL front, and multiple independent detections suggests a deliberate attempt to deceive Ledger users. Defenders should block the domain at network and endpoint layers, monitor for related C2 activity, and update detection signatures to include the observed nameserver and IP characteristics. Continuous re‑evaluation is advised as additional threat intelligence may emerge.