autodiscover[.]ledgerhardwarerun[.]com

This domain, autodiscover.ledgerhardwarerun.com, was registered on July 11, 2025, and is actively flagged as a high-risk crypto phishing operation targeting Ledger, a hardware wallet provider. Infrastructure analysis reveals the domain is hosted behind Cloudflare (AS13335), resolving to IP 172.67.130.142 in the United States. The nameservers (garrett.ns.cloudflare.com, marjory.ns.cloudflare.com) and detected technologies (Cloudflare, HTTP/3) align with common phishing infrastructure patterns, though no specific phishing kit or payload has been confirmed. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent but may aid in evading basic filters. At the time of assessment, the domain returns an HTTP 403 status with the page title 'Just a moment...', a Cloudflare interstitial commonly seen during bot challenges or misconfigured deployments. This may indicate the site is either in a preparatory phase or actively filtering traffic. Four of 95 security vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist, corroborating its malicious classification. The domain was registered through OwnRegistrar, Inc., a registrar occasionally associated with abusive registrations. While the exact content of the phishing page remains unanalyzed, the domain's naming convention ('autodiscover' prefix) and association with Ledger suggest an attempt to mimic legitimate service discovery endpoints, potentially to harvest credentials or distribute malware. Defenders should treat this domain as active and high-risk, blocking resolution at the DNS level and monitoring for related infrastructure. Further analysis of the site's content, if accessible, would clarify the specific phishing mechanics employed.