supportledgerconnect[.]com

Analysis indicates that supportledgerconnect.com was registered on 26 March 2026 through OwnRegistrar, Inc. and is hosted on the Cloudflare network, resolving to IP 172.67.132.53 located in Canada. The domain presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint and returning HTTP 200. The sole visible page title reads “Please verify you are human,” which aligns with a typical verification step used in credential‑harvesting flows, but the page content has not been publicly disclosed. The site is classified as a brand‑impersonation campaign targeting Ledger, and two of ninety‑four VirusTotal scanners have flagged it as malicious. It appears in a single AlienVault OTX pulse and is listed on one external blocklist; Gridinsoft assigns it a trust score of 0/100, and PhishDestroy reports it as blocked. Infrastructure analysis shows no additional anomalous hosts beyond the Cloudflare edge. Uncertainty remains regarding the exact phishing payload, credential collection mechanism, and any downstream command‑and‑control infrastructure, as no samples have been captured. Defenders should add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for the domain, and update email filtering rules to catch any messages referencing Ledger that reference this host. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this campaign.