Highscore 55 · flagged Thursday, September 17, 2026

cr-ledger.com

Appeared in the .com zone on Thursday, September 17, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

ambiguous brand word
matched: ledger
+4
brand name behind Cloudflare
matched: cloudflare.com
+6
brand in page title, not in the name
matched: google
+20
form on a brand-styled page
matched: has_form
+18
brand name redirects elsewhere
matched: google.com
+8
Registrar
Nameserver provider
Nameservers
apollo.ns.cloudflare.com, arya.ns.cloudflare.com
First-day state
redirects elsewhere
HTTP status
200
Page title
Google
Has a form
yes
Brand echoed
ledger

Model opinions

Second opinionsuspicioustarget: Ledgerconfidence 55%· claude-opus-5

Newly registered cr-ledger.com serves no content of its own, instead redirecting to www.google.com behind Cloudflare nameservers — a classic cloak/holding state for a domain awaiting deployment; 'ledger' evokes the Ledger crypto-wallet brand heavily abused in seed-phrase phishing, but the word is also generic accounting vocabulary, so the evidence is not yet decisive. None of the Google branding seen is impersonation by this domain.

First passlooks benignconfidence 95%· claude-haiku-4-5

cr-ledger.com is a redirect-only domain that points to www.google.com's legitimate homepage. The domain name contains 'ledger' (a Ledger cryptocurrency wallet brand word) but does not itself impersonate Google or any other organisation—it simply redirects users to Google's real site. The scorer's evidence flags a brand-word and Cloudflare nameservers, but a redirect to a legitimate destination with no deceptive landing page, login interception, or credential capture attempt on the redirect domai

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Thursday, September 17, 2026

Screenshot of cr-ledger.com taken by the zone census on 2026-09-17

Same data as JSON: /api/zone/domain/cr-ledger.com. This page is not indexed by search engines and does not link to the site it describes.