safe-hardware-wallet[.]pages[.]dev

This domain, safe-hardware-wallet.pages.dev, is flagged as an active brand impersonation threat targeting Ledger hardware wallet users. Analysis indicates the infrastructure is designed to deceive victims into interacting with a crypto drainer, likely through a fraudulent wallet setup or firmware update process. The page title, 'Ledger Hardware Wallet – Secure Crypto Storage Guide,' reinforces the deception by mimicking legitimate Ledger documentation and support resources. Infrastructure analysis reveals the domain was registered on March 06, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, located in Canada. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious domains. VirusTotal reports 10 out of 95 security vendors flagging this domain, while it appears on one security blocklist and is actively blocked by PhishDestroy. No detections from Google Safe Browsing were recorded at the time of analysis. The domain remains active as of this report, posing a continued risk to users who may mistake it for an official Ledger resource. Response actions should include immediate blacklisting by security providers, takedown requests to the hosting provider, and public warnings to the targeted brand’s user base. Despite existing detections, the domain’s persistence and use of Cloudflare’s infrastructure may delay mitigation efforts. Users are advised to verify domain authenticity through official channels and avoid interacting with unsolicited wallet-related communications.