ledger-mcp[.]pages[.]dev

This domain, ledger-mcp.pages.dev, is actively impersonating Ledger, a recognized hardware wallet provider, as indicated by the page title 'Ledger MCP - Privacy-First Financial AI' and the scam type classified as brand impersonation. Infrastructure analysis reveals the domain was registered on March 30, 2026, through Cloudflare and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network in Canada. The site employs Cloudflare nameservers (aaden.ns.cloudflare.com and wanda.ns.cloudflare.com) and enforces HSTS alongside HTTP/3, suggesting an attempt to appear legitimate through modern security protocols. Detection data shows the domain is flagged by one security vendor and blocked by PhishDestroy, while a Gridinsoft trust score of 0/100 further supports its classification as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, recent registration, and security vendor detections confirms its high-risk status. Defenders should treat this domain as an active threat, block resolution at the network level, and monitor for related infrastructure or certificate reuse. No additional threat actor attribution or campaign linkage is currently available.