help-nj-ledger[.]webflow[.]io

The domain help-nj-ledger.webflow.io is currently active and has been classified as a high‑risk brand‑impersonation operation targeting Ledger. Infrastructure analysis shows the site is hosted behind Cloudflare (IP 172.64.151.8, located in Canada) and uses a Google Trust Services certificate issued to WE1, indicating a valid TLS handshake. The domain was registered through the Webflow platform, and no authoritative nameservers are reported. An HTTP 200 response is returned, and the page title presented by the server reads "Ledger.com/Start® | Official - Ledger Support," directly copying Ledger’s branding. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal scans report 19 of 91 security vendors flagging the host, reinforcing the malicious assessment. Evidence confirms the domain’s intent to impersonate Ledger’s support portal, but the exact content of the landing page has not been captured in the available intelligence. Defenders should immediately block or sinkhole the domain, update corporate web‑filter and email‑security policies to flag any references to help-nj-ledger.webflow.io, and monitor Cloudflare‑associated IP ranges for related activity. Continuous observation is advised to detect any changes in hosting or content that could broaden the threat surface.