app--connect-ledgr[.]pages[.]dev

Analysis conducted on July 23, 2026 indicates that the domain app--connect-ledgr.pages.dev is associated with a brand‑impersonation campaign targeting Ledger. The site was registered on March 23, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.96.3 located in Canada. DNS records show the authoritative name servers denver.ns.cloudflare.com and wally.ns.cloudflare.com, consistent with the registrar. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, which is typical for Cloudflare‑proxied sites. HTTP requests return a 403 status code, and the page title returned is "Ledger - Crypto Wallet App", matching the declared impersonated brand. The infrastructure employs HSTS and HTTP/3, confirming modern web security features, but these do not mitigate the malicious intent.

Threat intelligence flags the domain on a single security blocklist and records a detection by PhishDestroy. VirusTotal analysis shows that 13 of 94 scanning engines label the domain as malicious, reinforcing the suspicion. Independent scoring from Gridinsoft rates the site at 0 out of 100, indicating extreme untrustworthiness. The classification in the intelligence set is a crypto‑scam, with the domain explicitly listed as impersonating Ledger. Uncertainty remains regarding the current content of the site because the domain is now offline and the HTTP 403 response prevents content retrieval.

No additional indicators such as malicious payload hashes, phishing page screenshots, or credential‑stealing scripts have been disclosed. Consequently, defenders cannot confirm the exact phishing workflow but can rely on the observed infrastructure and detection history. Mitigation guidance recommends adding the domain to internal blocklists, extending existing DNS filtering rules to include app--connect-ledgr.pages.dev, and monitoring for any future resolution to the same IP address or Cloudflare name servers.