strt-com-ledgr-faq[.]pages[.]dev

This domain, strt-com-ledgr-faq.pages.dev, is identified as a phishing site impersonating Ledger, a hardware cryptocurrency wallet provider. The site likely poses as official Ledger support or FAQ pages, designed to deceive users into entering sensitive information such as recovery phrases, private keys, or login credentials. Such attacks are commonly used to facilitate unauthorized access to cryptocurrency wallets, leading to direct financial theft through crypto draining techniques. The domain mimics legitimate support infrastructure, exploiting user trust in the Ledger brand to execute credential harvesting or malware distribution. Analysis indicates the domain has a VirusTotal detection score of 0 out of 95 security engines, suggesting it has not yet been widely flagged by automated scanning tools. It is registered through Cloudflare, Inc., and was created on April 03, 2026, indicating a recently established malicious infrastructure. The domain appears on one security blocklist and resolves to the IP address 172.66.47.61, which is part of Cloudflare’s network. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. The page title, 'Suspected phishing site | Cloudflare,' suggests that the hosting provider has detected and flagged the content, though the site remained accessible until being taken offline. Users who visited strt-com-ledgr-faq.pages.dev should assume their interaction was logged and any entered credentials or recovery phrases are compromised. Immediate action is required: revoke access to any connected cryptocurrency wallets, generate new recovery phrases, and transfer assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If personal or financial information was submitted, consider reporting the incident to relevant cybersecurity authorities and financial institutions. Avoid interacting with any communications claiming to be from Ledger that reference this domain, as they are likely part of the phishing campaign.