help-webb-ledger[.]webflow[.]io

Analysis on July 23, 2026 indicates that the domain help-webb-ledger.webflow.io is actively serving HTTP 200 responses and presents a TLS certificate issued by Google Trust Services under the WE1 certificate profile. The site is built on the Webflow platform and delivered through Cloudflare’s network, supporting HTTP/3. DNS resolution points to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc., located in the United States. Registration data show the domain was created on February 21, 2026 via NameCheap, Inc., and the authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The page title returned by the server is “Ledger.com/Start® | Official start using your device | Ledger”, directly referencing the Ledger brand.

Threat intelligence tags the site as a crypto‑related scam that impersonates Ledger, and the classification aligns with the observed brand‑impersonation behavior. VirusTotal reports that 15 of 93 scanning engines have flagged the domain as malicious, and the domain appears on one external blocklist. The security service PhishDestroy has already listed the domain as blocked, while Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. Current indicators suggest that the infrastructure is typical of credential‑harvesting or transaction‑draining campaigns targeting cryptocurrency users, though the exact payload or page content has not been publicly disclosed.

Defenders should treat the domain as high‑risk: network perimeter controls ought to deny HTTP/HTTPS traffic to the host, DNS filtering should block resolution of help-webb-ledger.webflow.io, and endpoint security solutions should incorporate the observed VirusTotal detections and the low Gridinsoft score into their alerting rules. Continuous monitoring of the associated IP address and Cloudflare ASN is recommended, as the attacker may shift to additional hostnames under the same infrastructure.