support-ledgrcom-helps--us[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation site specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site is designed to deceive users into disclosing sensitive credentials or installing malicious software under the guise of legitimate Ledger support services, a tactic commonly associated with crypto drainer schemes. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 22, 2025, and resolves to the IP address 172.66.44.138, located in Canada. The domain appears on one security blocklist, with PhishDestroy actively blocking it. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the page title mimics the legitimate Ledger onboarding process, displaying 'Get Started with Ledger — Ledger.com/start.' The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Mitigation measures for this type of threat include immediate revocation of any credentials entered on the site, particularly cryptocurrency wallet recovery phrases or private keys. Users should verify the authenticity of any Ledger-related communication by cross-referencing official domains and avoiding links from unsolicited messages. Organizations are advised to implement domain monitoring for similar impersonation patterns, such as typosquatting or subdomain abuse, and enforce strict validation of SSL certificates issued by non-enterprise certificate authorities. Security teams should update blocklists to include the domain and its associated IP, while end-users should enable multi-factor authentication on all cryptocurrency-related accounts to mitigate credential theft risks.