doc-access-ledger[.]pages[.]dev

This domain, doc-access-ledger.pages.dev, is identified as an active brand impersonation threat targeting Ledger, a manufacturer of cryptocurrency hardware wallets. The site presents itself as an official store for Ledger products, using the page title 'Ledger® Hardware Wallet | Official Store for Safe Crypto | Lédger®' to deceive users into believing it is a legitimate platform for purchasing or managing crypto assets. The threat type is classified as high-risk due to its direct targeting of financial and cryptographic security infrastructure. Analysis indicates the domain was registered through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, located in Canada under Cloudflare’s infrastructure. The domain was created on April 22, 2026, though this date may reflect a falsified registration record. Detection data reveals the domain is flagged by 9 of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious domains leveraging legitimate certificate authorities to appear trustworthy. Infrastructure analysis further confirms the domain remains operational as of the latest verification. The current status of doc-access-ledger.pages.dev is active, posing an ongoing risk to users seeking Ledger hardware wallets or related services. Recommendations include immediate blocking of the domain and IP address within network security policies. Users are advised to verify the authenticity of any Ledger-related website by cross-referencing official domains provided by the vendor. Organizations should monitor for indicators of compromise, including the domain, IP, and associated SSL certificate fingerprint, to prevent credential theft or unauthorized transactions. Proactive threat intelligence sharing is recommended to mitigate further exploitation of this infrastructure.