connect-ldgeir-wallet[.]pages[.]dev

Analysis of connect-ldgeir-wallet.pages.dev indicates an active brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered on April 9, 2026, through Cloudflare, Inc., currently resolves to 172.66.44.91 and maintains an HTTP 200 status, confirming operational status as of July 12, 2026. The page title, 'Ledger Wallet® - Starting Up Your Device,' directly aligns with Ledger's branding, reinforcing the impersonation classification. Infrastructure analysis reveals Cloudflare nameservers (emely.ns.cloudflare.com, sullivan.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), a common pattern observed in phishing domains leveraging reputable service providers to evade detection. Security vendors have flagged this domain, with 17 out of 94 engines on VirusTotal identifying it as malicious. Google Safe Browsing has classified it under 'SOCIAL_ENGINEERING,' and it appears on at least one security blocklist. The domain's trust score is 0/100, further supporting its high-risk classification. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, SSL certificate, and hosting through a major CDN suggests an attempt to deceive users into interacting with fraudulent wallet setup or recovery processes. Defenders should prioritize blocking this domain at the DNS or proxy level, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related subdomains or IP resolutions (e.g., 172.66.44.91) may help identify additional infrastructure tied to this campaign. Given the domain's recent registration and active status, continued vigilance is recommended to mitigate potential user exposure.