growuledger[.]com

The domain growuledger.com was registered on April 14 2026 through Dynadot Inc. It is being used to impersonate the Ledger brand, as indicated by the threat label “brand_impersonation” and the explicit branding target in the intelligence. The domain’s creation date, proximity to the brand name, and alignment with a known impersonation campaign place it within a high‑risk profile. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, resolving to IP address 104.21.70.199, which GeoIP maps to Canada and is owned by Cloudflare, Inc. Authoritative nameservers are dell.ns.cloudflare.com and ray.ns.cloudflare.com, both standard Cloudflare resolver entries. The site presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS layer. An MX record is defined with priority 10 pointing to a sub‑domain _dc-mx.755f9a6c88a9.growuledger.com, a pattern often observed in malicious deployments to enable outbound email. Observational indicators include an HTTP 403 response and a page title of “Just a moment…”, which is typical of Cloudflare challenge pages and may be used to obscure malicious content. The domain is listed on one security blocklist, has been flagged by four of ninety‑five VirusTotal scanners, and appears in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, confirming active mitigation. Defenders should add growuledger.com to block and sinkhole lists, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to capture any hidden payload behind the challenge page. Because the site content behind the challenge has not been captured, additional analysis of the final response after challenge completion is recommended to verify any credential‑ harvesting functions. Continuous re‑evaluation is advised as the infrastructure may be altered or redirected.