io-edger-wallet[.]pages[.]dev

This domain, io-edger-wallet.pages.dev, presents a direct threat as a brand impersonation phishing site targeting Ledger hardware wallet users. The page mimics the official Ledger interface, using the title 'Ledger Wallet – Secure Hardware Crypto Wallets' to deceive victims into entering sensitive credentials or recovery phrases. Analysis indicates the site is designed to harvest cryptocurrency wallet details, likely functioning as a crypto drainer to siphon funds from compromised accounts. The domain’s infrastructure and content are crafted to exploit trust in the Ledger brand, a common tactic in financial phishing campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare on October 25, 2025, and resolves to the IP address 188.114.96.3. Despite its malicious intent, the domain has not yet been widely flagged by security vendors, with VirusTotal showing 0 detections out of 95 engines. However, Google Safe Browsing has classified the site under 'SOCIAL_ENGINEERING,' and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services, and the site employs HSTS and HTTP/3, which may lend an appearance of legitimacy to unsuspecting users. Users who visited io-edger-wallet.pages.dev should immediately cease all interaction with the site and assume any credentials or recovery phrases entered are compromised. Affected individuals should transfer remaining assets from potentially exposed wallets to a new, secure wallet using an offline device. It is also recommended to monitor transaction histories for unauthorized activity and enable additional security measures such as multi-factor authentication where applicable. Given the domain’s recent creation and low detection rate, users should remain vigilant for similar phishing attempts targeting cryptocurrency hardware wallets.