cloud--en-ledgecom-us[.]pages[.]dev

The domain cloud--en-ledgecom-us.pages.dev has been identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was actively spoofing the Ledger brand, presenting a page titled 'Ledger – Getting Started' to deceive users into disclosing sensitive credentials or installing malicious software. The domain is currently offline, though prior activity suggests it was operational for a limited period. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 12, 2026, and resolved to the IP address 172.66.44.81. Detection metrics indicate minimal initial flagging, with 0 of 95 vendors on VirusTotal identifying the domain as malicious at the time of assessment. The domain appears on a single security blocklist, while Gridinsoft assigned a trust score of 0 out of 100. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging Cloudflare infrastructure. Current status confirms the domain has been taken offline, though the infrastructure remains a potential vector for future threats. Organizations and users are advised to monitor for similar domains leveraging Cloudflare-hosted subdomains, particularly those impersonating cryptocurrency-related brands. Network-level blocking of the IP 172.66.44.81 and domains registered under the same pattern is recommended as a precautionary measure. Security teams should prioritize reviewing logs for connections to this IP or domain to identify potential prior exposure.