connect-ledgrwalite[.]pages[.]dev

The domain connect-ledgrwalite.pages.dev was registered on September 18, 2025 through Cloudflare, Inc. The authoritative name servers are greg.ns.cloudflare.com and nova.ns.cloudflare.com, and the domain resolves to 188.114.97.3, an IP address owned by Cloudflare, Inc. and geolocated to Canada. The site serves an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS certificate despite malicious intent. HTTP responses return status 200 and the page title observed is “Ledger Wallet Setup | Start Securing Your Crypto,” aligning with the declared brand target Ledger and the crypto‑scam classification. The infrastructure employs Cloudflare’s security stack, including HSTS and HTTP/3. Threat intelligence flags the domain as a high‑risk brand‑impersonation campaign; it appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans show 13 of 91 security vendors flag the domain, reinforcing the malicious assessment. The Gridinsoft trust score is 0/100. Current evidence confirms active operation as of July 12, 2026. Uncertainties remain regarding the exact phishing kit or payload delivered, as page content has not been analysed beyond the title. Defenders should block the domain at network perimeter, update URL filtering rules to include the full hostname, and monitor for related C2 indicators tied to the Cloudflare IP range. Ongoing observation of any new detections or changes in blocklist status is advised.