ledger-suit[.]pages[.]dev

PhishDestroy identifies ledger-suit.pages.dev as a brand impersonation threat specifically targeting the Ethereum ecosystem. The domain mimics the legitimate Ledger Live platform, attempting to deceive users into downloading a fraudulent crypto wallet app. This type of attack often leads to credential theft or crypto drainer installation, posing significant financial risk to victims.

The technical profile of ledger-suit.pages.dev reveals several key indicators. VirusTotal shows 0 out of 95 security vendors detecting malicious activity, meaning the domain has not yet been widely flagged. It was registered on September 11, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.46.254. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. The domain appears on one security blocklist, indicating limited but existing recognition of its malicious nature. Notably, it is not listed on Google Safe Browsing, which reduces visibility to some users.

As of the latest analysis, the domain is offline, suggesting it has been taken down either by the hosting provider or through security interventions. However, the risk is not entirely mitigated as similar domains may reappear. PhishDestroy recommends that users avoid any interaction with ledger-suit.pages.dev and report it to relevant authorities. Users should always verify URLs by manually typing known addresses and only download wallet software from official sources. For those who may have visited the site, immediate credential rotation and monitoring of crypto assets are advised.