cloud-hardware-wallet[.]pages[.]dev

This domain, cloud-hardware-wallet.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates it mimics the official Ledger hardware wallet interface, as evidenced by the page title "Ledger® Hardware: Wallet® — Getting Started," a direct attempt to deceive users into believing they are interacting with legitimate Ledger services. The domain does not currently show evidence of a drainer kit in initial scans, but the impersonation of a cryptocurrency hardware wallet brand poses a significant risk of credential theft or unauthorized transactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with a creation date of March 12, 2026, and resolves to the IP address 172.66.44.179, located in the United States under AS13335. The SSL certificate is identified as E8, a common Cloudflare-managed certificate. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal. Google Safe Browsing (GSB) status is not explicitly listed, but the domain is actively blocked by at least one known security filter. As of the latest verification, cloud-hardware-wallet.pages.dev remains active and continues to host the fraudulent Ledger impersonation page. Immediate response actions include blacklisting the domain across security platforms, revoking SSL trust for the certificate, and notifying the hosting provider for takedown. Despite these measures, the remaining risk is elevated due to the domain's persistence and the high-value target of cryptocurrency users. Users are advised to avoid interaction, verify official Ledger domains directly, and report any suspicious activity to their security providers.