ledgercomtart[.]pages[.]dev

This domain, ledgercomtart.pages.dev, is flagged as a brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site was designed to deceive users into submitting sensitive credentials or wallet recovery phrases, likely under the pretense of account verification or security updates. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns commonly used to facilitate unauthorized access to digital assets.

Infrastructure analysis reveals the domain was registered on September 04, 2025, through Cloudflare, Inc., and resolves to the IP address 104.21.96.1, associated with AS13335 (Cloudflare, Inc.). The domain appears on one security blocklist, and detection engines report a VirusTotal score of 10/95. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to mimic legitimacy. Google Safe Browsing (GSB) has not yet classified this domain, though the low blocklist count suggests it may have evaded broader detection during its operational window.

As of the latest assessment, ledgercomtart.pages.dev has been taken offline, likely following reports to the hosting provider or domain registrar. However, the risk remains elevated for users who may have interacted with the site prior to its removal. Historical DNS records and cached content may still pose a threat if accessed through archival services. Users are advised to verify any communications purportedly from Ledger through official channels and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.