home-ljer-us[.]pages[.]dev

PhishDestroy identifies home-ljer-us.pages.dev as a live brand impersonation scam currently masquerading as Ledger’s official platform. The site is actively resolving to 172.66.47.7 under a Google Trust Services SSL certificate, with the deceptive page title Ledger Start – Secure Your Crypto to lure victims into fraudulent transaction flows. This threat operates under Cloudflare’s pages.dev infrastructure and remains unblocked by security vendors despite clear malicious intent.

This domain was flagged by 8 of 95 VirusTotal vendors at initial scan, indicating a low detection rate that may allow broader exposure before remediation. It is hosted on IP 172.66.47.7, registered via Cloudflare, Inc., and leverages Google Trust Services for SSL to increase perceived legitimacy. The landing page mimics Ledger’s branding to deceive users into connecting crypto wallets and authorizing malicious transaction approvals, a tactic consistent with crypto drainer operations. No blocklist entries were recorded at time of analysis, suggesting recent deployment and rapid propagation.

This domain remains active and poses a high risk to users seeking Ledger services. PhishDestroy urges immediate network and endpoint blocking of home-ljer-us.pages.dev and associated IP 172.66.47.7. Users are advised to verify all crypto-related URLs via official Ledger channels, avoid clicking unsolicited links, and report suspicious wallet connection prompts. Security teams should monitor for drainer signatures and update threat intelligence feeds promptly to prevent asset loss.