ladger-wallet-docs[.]pages[.]dev

This report details a fraudulent website impersonating the Ledger brand to conduct cryptocurrency theft. The site, using the title "Ledger Wallet — Security for Your Device," posed as a legitimate Ledger wallet service. The primary threat was credential harvesting or phishing, designed to trick users into entering sensitive wallet information, leading to the theft of cryptocurrency assets.

Technical analysis reveals 9 out of 95 VirusTotal vendors flagged the domain as malicious, including ADMINUSLabs, BitDefender, CyRadar, ESET, and Fortinet. The domain was registered through Cloudflare, Inc. and created on 2025-09-23. It was hosted on IP address 188.114.96.3, associated with CloudFlare, Inc. in Canada. The SSL certificate was issued by Google Trust Services / WE1. The domain used nameservers felicity.ns.cloudflare.com and nadia.ns.cloudflare.com. GridinSoft assigned a trust score of 0 out of 100, and the domain risk score was 68.

As of the latest check, the site is DOWN and OFFLINE. The confirmed impersonation of the Ledger brand, combined with the high number of security vendor flags and low trust scores, classifies this as a high-risk threat. Users who may have interacted with the site should be advised to change their Ledger credentials and monitor for unauthorized transactions.