ladger-wllt[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger Wallet users. Analysis indicates the infrastructure is designed to deceive victims into disclosing cryptocurrency wallet credentials or installing malicious software under the guise of secure DeFi and Web3 access. The page title, "Ledger Wallet - Secure DeFi & Web3 Access," directly mimics legitimate Ledger branding to exploit user trust. Infrastructure analysis reveals the domain ladger-wllt.pages.dev was registered on April 30, 2026, through Cloudflare, Inc. It resolves to the IP address 172.66.45.44, hosted in a Canadian data center operated by Cloudflare. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. VirusTotal detection shows 11 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Despite these detections, the site remains active, increasing the risk of successful compromise. Mitigation steps for this threat type include immediate blacklisting of the domain and IP address across all security gateways. Network administrators should implement DNS sinkholing to prevent resolution of ladger-wllt.pages.dev. End users should be educated to verify domain authenticity before entering credentials, particularly for cryptocurrency-related services. Organizations should monitor for connections to 172.66.45.44 and alert on any outbound traffic to this IP. Given the high-risk nature of credential harvesting in cryptocurrency theft, affected users should revoke access to any wallets or services accessed via this domain and enable multi-factor authentication where available.