store-ledgr-eng[.]pages[.]dev

This domain, store-ledgr-eng.pages.dev, is confirmed to operate as a credential harvesting platform specifically targeting Ledger cryptocurrency wallet users. Analysis indicates the site employs brand impersonation techniques to deceive victims into entering sensitive recovery phrases, private keys, or account credentials under the pretense of wallet recovery, firmware updates, or security verification processes. The infrastructure mimics legitimate Ledger support portals, including visual design elements and domain naming conventions that closely resemble official Ledger services, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 4, 2026, an anomalous creation date suggesting potential domain spoofing or registry manipulation. The domain resolves to IP address 172.66.44.135 and currently maintains a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged the domain as malicious at the time of assessment. Despite this, the domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider, though the domain remained active long enough to pose a significant threat to unsuspecting users. Users who visited store-ledgr-eng.pages.dev or entered any credentials on the site must assume full compromise of their Ledger wallet and associated cryptocurrency assets. Immediate action is required: revoke all active sessions, generate new wallet addresses, and transfer remaining funds to a secure, offline wallet using a clean device. If recovery phrases or private keys were disclosed, consider the original wallet permanently compromised and avoid reusing it. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant blockchain security teams and local cybercrime authorities to assist in tracking and mitigating further fraudulent activity.