guide-hashpak-en[.]pages[.]dev

The domain guide-hashpak-en.pages.dev is flagged as a high‑risk brand‑impersonation operation targeting Ledger. Registration occurred on October 31, 2025 through Cloudflare, Inc., and the site resolves to IP 172.66.47.16, part of AS13335 Cloudflare in the United States. Infrastructure analysis shows the presence of HSTS, Cloudflare services, and HTTP/3 support, with a TLS certificate issued by Google Trust Services under the WE1 label. The page title retrieved from the live site reads "HashPack Wallet — Secure Gateway to Hedera," indicating a cryptocurrency‑related lure. Google Safe Browsing has marked the domain for social engineering, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal has processed the domain with scans from 91 vendors, though no detections have been reported. Nameservers seamus.ns.cloudflare.com and tara.ns.cloudflare.com are in use. While the page title confirms a cryptocurrency narrative, the specific content and credential‑capture mechanisms have not been publicly disclosed. Defenders should add the domain to network‑level deny lists, monitor DNS queries for the associated IP and nameservers, and treat any traffic to the site as malicious. Continuous re‑evaluation is advised, as threat actors may modify the payload or hosting configuration without notice.