us-ledgerr-wallet[.]pages[.]dev

This domain is flagged for elevated risk due to brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site operates as a fraudulent replica designed to deceive users into entering sensitive credentials or wallet recovery phrases, likely functioning as a crypto drainer to siphon digital assets from victims. Analysis indicates the domain us-ledgerr-wallet.pages.dev was registered through Cloudflare Pages and created on March 27, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 172.66.47.117 and uses an SSL certificate issued by Google Trust Services. The page title reads 'Suspected phishing site | Cloudflare,' a clear indicator of malicious intent. VirusTotal reports 9 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and was actively blocked by anti-phishing systems prior to being taken offline. Mitigation steps for users and organizations include immediate blocking of the domain and its resolving IP address across all network security controls. Ledger users should verify the authenticity of any wallet-related site by cross-referencing official domains listed on the company’s verified support channels. Security teams are advised to monitor for similar brand impersonation patterns, particularly domains using Cloudflare Pages infrastructure with future-dated registrations or anomalous SSL issuers. Endpoint protection should be configured to detect and prevent access to domains with low trust scores and high vendor detection rates on threat intelligence platforms.