supported-ledge[.]pages[.]dev

This domain is flagged as a high-risk threat due to brand impersonation targeting Ledger, a manufacturer of cryptocurrency hardware wallets. Analysis indicates the site mimics Ledger’s official branding, including the page title 'HomePage | Ledger Hardware Wallet™,' to deceive users into disclosing sensitive credentials or installing malicious software. The specific threat type involves credential harvesting and potential malware distribution under the guise of a trusted hardware wallet provider. Infrastructure analysis reveals the domain was registered on April 19, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.167, located in California. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging legitimate CDN infrastructure. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Despite these indicators, the site remains active, increasing the risk of exposure to unsuspecting users. Mitigation steps for this threat type include immediate blocking of the domain and IP address at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly in environments where cryptocurrency-related activities occur. Users should be educated to verify the legitimacy of Ledger-related communications by cross-referencing URLs with the official Ledger website and avoiding interaction with unsolicited links. Security teams are advised to monitor for related domains using similar naming conventions (e.g., 'ledge,' 'support-ledger') and implement proactive DNS filtering to disrupt further phishing attempts.