ledgerr-wllet-app[.]pages[.]dev

This domain, ledgerr-wllet-app.pages.dev, is flagged as an active high-risk phishing site impersonating Apple, specifically targeting users with a tech support scam. Registered on September 9, 2025, the domain is hosted on Cloudflare infrastructure, resolving to an IPv6 address (2606:4700:310c::ac42:2fb2) under AS13335. The page title, 'Ledger Wallet: | Sign Your Account,' suggests an attempt to deceive users into believing they are accessing a legitimate Apple service, though the exact content and mechanisms of the scam remain unconfirmed due to the absence of direct website analysis. Infrastructure analysis reveals the use of Cloudflare technologies, including HSTS and HTTP/3, which are commonly employed to enhance security and performance but are also leveraged by malicious actors to evade detection. The domain is associated with Cloudflare nameservers (greg.ns.cloudflare.com and mckinley.ns.cloudflare.com) and holds a valid SSL certificate issued by Google Trust Services (WE1), further complicating efforts to distinguish it from legitimate services. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and is blocked by at least one security vendor (PhishDestroy). Gridinsoft assigns it a trust score of 0/100, reinforcing its classification as malicious. While two of 95 security vendors on VirusTotal flag this domain, the absence of broader detection does not indicate safety, as phishing domains often evade initial scans. Defenders should treat this domain as a confirmed threat, particularly given its association with a known scam type (tech support) and brand impersonation (Apple). Network-level blocking is recommended, along with monitoring for related domains or IP addresses within the same infrastructure. The domain's recent creation and continued activity suggest it may be part of a larger campaign, warranting further investigation into its distribution methods and potential ties to other malicious infrastructure.