support-eng-ledge[.]pages[.]dev

This domain, support-eng-ledge.pages.dev, is confirmed to operate as an active crypto wallet drainer targeting users of the Ledger hardware wallet brand. Analysis indicates the site employs brand impersonation techniques to deceive victims into connecting compromised cryptocurrency wallets, facilitating unauthorized fund transfers. The infrastructure remains operational as of this assessment. Infrastructure analysis reveals the domain was registered on April 22, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, geolocated to Canada under Cloudflare's network. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic in both legitimate and malicious sites leveraging Cloudflare's hosting services. Detection metrics show the domain is flagged by 12 of 95 security vendors on VirusTotal, while appearing on one security blocklist, specifically PhishDestroy. The page title, 'Ledger Start - Getting Started Ledger,' closely mimics official Ledger documentation to enhance credibility. Current status indicates the domain remains active and poses a high risk to cryptocurrency users. The presence of wallet-draining scripts suggests the primary objective is the theft of digital assets rather than credential harvesting alone. Users are advised to immediately block the domain and associated IP address within network security controls. Organizations should update endpoint protection rules to detect and prevent access to this infrastructure. Victims are urged to revoke any wallet connections made through this domain and monitor transaction histories for unauthorized activity. Due to the persistent nature of such campaigns, continuous monitoring for similar domains using the 'ledge' or 'support-eng' naming conventions is recommended.