ledger-web-com[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Ledger, a cryptocurrency wallet provider. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with the legitimate Ledger Live platform, likely for credential theft or crypto asset compromise. The page title, 'Ledger Live | Secure Crypto Wallet & Portfolio Manager,' directly mirrors the official branding, increasing the likelihood of successful social engineering attacks against Ledger users. Infrastructure analysis reveals the domain ledger-web-com.pages.dev was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3. The domain was created on April 18, 2026, though this date may reflect a falsified registration record. Security vendors on VirusTotal flagged the domain as malicious, with 11 out of 95 engines detecting it. The domain appears on one security blocklist and is blocked by PhishDestroy. Additional trust scoring from Gridinsoft assigns a score of 0/100, further confirming its malicious nature. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's fraudulent intent. Mitigation steps for users and organizations include immediately blocking the domain and its resolving IP (188.114.96.3) at the network level. Users who may have interacted with this domain should assume credential compromise and take immediate action: revoke access to any connected crypto wallets, enable multi-factor authentication on all accounts, and monitor for unauthorized transactions. Organizations managing crypto-related services should proactively warn users about this specific threat and implement real-time domain monitoring to detect similar impersonation attempts. Given the elevated risk of financial loss, affected users should also report the incident to relevant cybersecurity authorities and their wallet providers for further investigation.