home-connect-ledger-en-us[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into entering sensitive wallet credentials, recovery phrases, or private keys under the pretense of legitimate Ledger services. The threat type aligns with known cryptocurrency phishing campaigns that exploit brand trust to facilitate unauthorized asset transfers or account takeovers. Infrastructure analysis reveals the domain home-connect-ledger-en-us.pages.dev was registered through Cloudflare, Inc. on September 08, 2025, and resolves to the IP address 172.66.47.94, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification, as Cloudflare’s automated systems have preemptively labeled it as suspicious. Mitigation steps for this threat type include immediate cessation of interaction with the domain and any associated links. Users who may have entered credentials or recovery phrases should assume compromise and take the following actions: transfer assets to a new wallet, revoke any connected dApp authorizations, and generate a new recovery phrase for their Ledger device. Organizations and individuals should update blocklists to include the domain and its resolving IP (172.66.47.94) to prevent future access. Monitoring for similar domains using permutations of 'ledger,' 'connect,' and 'home' is recommended, as threat actors frequently rotate infrastructure. Additionally, enabling multi-factor authentication on all cryptocurrency-related accounts can reduce the risk of unauthorized access even if credentials are compromised.