hrdware-wallet-ldzr[.]pages[.]dev

PhishDestroy identifies hrdware-wallet-ldzr.pages.dev as a deceptive domain actively impersonating the Ledger brand to target cryptocurrency users. This platform is currently under investigation for malicious intent, with indicators suggesting a crypto-draining campaign designed to trick victims into surrendering private keys or seed phrases. The page title—"Ledger Wallet – Secure Your Crypto Assets"—mirrors official Ledger branding to establish false legitimacy and exploit user trust in hardware wallet security.

This domain was flagged by 8 of 95 VirusTotal vendors as of the latest scan, indicating it has not yet been widely recognized as malicious despite clear impersonation tactics. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.45.3 and operates under a Google Trust Services SSL certificate, which may further obscure its malicious nature. The use of Cloudflare Pages infrastructure adds a veneer of legitimacy, while the absence of detections suggests evasion of automated detection systems. Given its active status and the absence of protective indicators, this domain presents a clear risk to cryptocurrency holders seeking secure wallet solutions.

As this threat remains active and under investigation, PhishDestroy advises organizations and individuals to block access to hrdware-wallet-ldzr.pages.dev at the network level and educate users to verify domain authenticity before entering sensitive information. Monitor network traffic for connections to 172.66.45.3 and inspect SSL certificates for anomalies. Consider reporting this domain to threat intelligence platforms and security vendors to improve detection coverage. Exercise heightened caution when accessing Ledger-related services and cross-reference URLs with official channels to prevent credential theft or fund loss.