ledger-wallet[.]gitlab[.]io

This domain, ledger-wallet.gitlab.io, is actively serving content that claims to be the official Ledger onboarding site, as indicated by the page title “Official Site® | Ledger.com/Start® | Getting started.” The host resolves to IP 35.185.44.232, which belongs to Google LLC (AS396982) and is located in the United States. DNS is delegated to Cloudflare nameservers MAXIM.NS.CLOUDFLARE.COM and NIA.NS.CLOUDFLARE.COM. The site presents an HTTPS certificate issued by GlobalSign nv-sa, using the GlobalSign GCC R6 AlphaSSL CA valid through 2025. Infrastructure analysis shows the presence of Ruby, Ruby on Rails, Vue.js, Salesforce, Stripe, Zendesk, Google Cloud, and Apple iCloud Mail components, suggesting a typical web-application stack. VirusTotal reports that 9 of 95 scanning engines flag the domain, and Gridinsoft assigns a trust score of 0/100. The domain is listed on five public blocklists and is already blocked by PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. Registration was performed through GANDI SAS. The HTTP response is a 302 redirect, and the current risk assessment is high under a seed_phish classification. While the page content beyond the title has not been publicly disclosed, the convergence of a legitimate‑looking title, a low trust score, multiple vendor detections, and active blocklist listings indicates a purposeful impersonation of Ledger. Defenders should block the domain at network perimeter, add it to local blacklists, and monitor for any related C2 activity. Continuous re‑evaluation is recommended as additional intelligence becomes available.