ledger[.]fintrack[.]link

This domain, ledger.fintrack.link, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as confirmed by infrastructure and intelligence indicators. Registered on June 6, 2025, through 1API GmbH, the domain resolves to IP 188.114.97.3, hosted under Cloudflare, Inc. in Canada. The site returns an HTTP 200 status, indicating an operational phishing page with the title 'FinTrack Ledger.' Analysis of the domain's technical footprint reveals the use of Cloudflare and Cloudflare Browser Insights, alongside HTTP/3, suggesting modern, evasive hosting practices. A phishing kit identified as an 'Airdrop Scam' is deployed, aligning with common cryptocurrency-related fraud tactics targeting Ledger users. The domain appears on one security blocklist and is flagged by four of 91 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, further corroborating its malicious nature. SSL certification is provided by Google Trust Services (WE1), a legitimate but frequently abused certificate authority in phishing operations. Defenders should treat this domain as high-risk, block resolution at the DNS or network level, and monitor for related infrastructure leveraging the same nameservers (jeremy.ns.cloudflare.com, sima.ns.cloudflare.com) or hosting provider. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, phishing kit deployment, and active hosting infrastructure confirms its intent to deceive users into divulging sensitive information or transferring assets.