ledger-hardwere-wallet-welcome[.]pages[.]dev

This domain, ledger-hardwere-wallet-welcome.pages.dev, is actively impersonating Ledger, a hardware wallet provider, as confirmed by its page title ('Hardware Wallets – List of All Ledger Hardware Wallets') and brand target classification. Registered on March 28, 2026, through Cloudflare Pages, the domain resolves to IP 188.114.96.3, hosted on Cloudflare infrastructure in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common feature of both legitimate and malicious sites. Analysis indicates a high-risk brand impersonation scam, with a Gridinsoft trust score of 0/100 and presence on one security blocklist (PhishDestroy). Thirteen of 94 security vendors on VirusTotal flag the domain as malicious, though the exact nature of the threat (e.g., credential harvesting, malware distribution) remains unconfirmed due to limited content analysis. Defenders should treat this domain as an active phishing threat targeting Ledger users. The Cloudflare Pages origin suggests potential for rapid takedown, but the site remains operational as of July 12, 2026. Network-level blocking is recommended, particularly for organizations handling cryptocurrency or financial services. Further investigation into associated infrastructure (e.g., redirect chains, payment portals) may reveal additional malicious domains or campaigns. No evidence currently links this domain to a broader phishing kit or known threat actor group.