ledgerrcom-run[.]pages[.]dev

This domain poses a specific threat of brand impersonation, targeting the well-known cryptocurrency hardware wallet brand, Ledger. The domain ledgerrcom-run.pages.dev was designed to deceive users into believing it is an official Ledger website, which could lead to the theft of sensitive information such as login credentials and personal data.

Infrastructure analysis reveals that the domain was created on September 08, 2025, and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting visitors. The domain currently resolves to the IP address 188.114.97.3, located in the United States and associated with Cloudflare, Inc. (AS13335). On VirusTotal, 18 out of 95 security vendors flagged this domain as suspicious, indicating a significant level of concern. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its malicious intent.

If users have visited this domain, they should immediately change their Ledger account passwords and any other passwords that may have been used on the site. It is advisable to monitor financial and account activity for any unusual transactions or unauthorized access. Users should also consider enabling two-factor authentication (2FA) on their Ledger accounts and any other critical services. Reporting the incident to Ledger's support team and reviewing security settings can help mitigate potential damage.