ledger-cds[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting Ledger users via the domain ledger-cds.pages.dev. This threat poses as Ledger’s customer support portal, luring victims into surrendering sensitive cryptocurrency wallet credentials. The risk level remains under investigation, but the domain’s live status and low detection rate demand immediate attention from organizations and individual users alike.

This domain was flagged for impersonating Ledger’s brand to harvest wallet seeds, private keys, and recovery phrases. It leverages a Google Trust Services SSL certificate for credibility, resolving to IP 172.66.46.225 through Cloudflare, Inc. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating it has not yet been widely recognized by security platforms. The domain is hosted on Cloudflare Pages under the pages.dev subdomain, a known service abused by threat actors for rapid deployment and evasion. The registrant remains masked, typical of fraudulent infrastructure designed for short operational lifespans.

To mitigate exposure, users should immediately block ledger-cds.pages.dev at DNS and firewall levels. Avoid clicking any links or downloading content from this domain. Verify support channels directly via Ledger’s official website or verified social media. Report the domain to Ledger’s abuse team and your email/security provider. Organizations should update threat intelligence feeds and firewall rules to include this domain and its IP. Stay vigilant—this campaign is likely to evolve or relocate quickly due to its low detection footprint.