dapp-conn[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site employs deceptive tactics to mimic legitimate Ledger services, potentially tricking users into disclosing sensitive credentials or installing malicious software under the guise of a cryptocurrency protocol (page title: ordialsynprotocol). The domain poses a significant risk to users unfamiliar with Ledger’s official infrastructure, particularly those interacting with decentralized applications (dApps). Analysis indicates the domain dapp-conn.pages.dev was registered on July 10, 2024, through Cloudflare, Inc. and currently resolves to the IP address 172.66.47.131, hosted on Cloudflare’s network (AS13335). VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s CDN. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Infrastructure analysis reveals the use of Cloudflare Pages (pages.dev), a platform frequently abused for hosting phishing content due to its free tier and ease of deployment. Mitigation steps for this threat include immediate blacklisting of the domain and its resolving IP (172.66.47.131) at the network perimeter. Organizations should update endpoint protection rules to detect and block access to the domain, particularly for users handling cryptocurrency transactions. Security teams are advised to monitor for additional subdomains or variations under the pages.dev namespace, as threat actors often rotate infrastructure. Users should be educated to verify Ledger’s official domains and avoid interacting with unsolicited dApp connection prompts. If compromise is suspected, credentials should be revoked immediately, and all connected wallet sessions terminated.