wvvw-laedger[.]net

Analysis of the domain wvvw-laedger.net indicates active phishing infrastructure targeting cryptocurrency wallet users, specifically those associated with Ledger hardware wallets. The domain was registered on July 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. It resolves to the IP address 104.21.82.206, hosted on Cloudflare infrastructure in Canada, and employs Cloudflare nameservers (arushi.ns.cloudflare.com and louis.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for phishing sites leveraging Cloudflare's services. The domain is flagged on three security blocklists and is actively blocked by at least three detection systems, including MetaMask and SEAL. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. The HTTP status code 520, typically indicating a server error, may suggest attempts to restrict access or evade automated analysis. The page title 'Access Restricted' could imply conditional access controls or a placeholder for a phishing landing page. Technologies detected include Cloudflare Browser Insights and HTTP/3, consistent with modern phishing campaigns utilizing CDN services to obfuscate hosting origins. While one security vendor on VirusTotal flags the domain, the absence of broader detection does not diminish its risk, as phishing infrastructure often evades initial scans. Defenders should prioritize blocking this domain at the DNS and network layers, particularly in environments where cryptocurrency wallet interactions occur. Further investigation into the site's content is warranted to confirm the exact phishing mechanism, though the domain's naming convention and blocklist presence strongly suggest malicious intent.