ledger-wallet--info[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically designed to deceive users of Ledger hardware wallets. Analysis indicates the site likely functions as a crypto drainer, tricking victims into connecting their wallets to malicious smart contracts that siphon funds without authorization. The domain mimics legitimate Ledger branding to exploit user trust in the targeted cryptocurrency security product. Infrastructure analysis reveals multiple technical indicators of compromise. The domain ledger-wallet--info.pages.dev was registered on March 28, 2026, through Cloudflare, Inc., and currently resolves to IP address 172.66.47.64. VirusTotal detection shows 14 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the page title reads 'Ledger Wallet: Explained - TIOmarkets,' which does not match legitimate Ledger communications. The domain appears on one security blocklist, confirming its malicious classification. Mitigation requires immediate action from both users and security teams. Users who visited this domain should disconnect any connected wallets, revoke smart contract approvals via blockchain explorers, and monitor their accounts for unauthorized transactions. Security teams should block the domain and IP at the network perimeter, add detection rules for the page title pattern, and alert users about this specific brand impersonation campaign. Wallet providers should implement transaction simulation warnings when users attempt to connect to domains matching this infrastructure pattern. Given the high-risk nature of crypto drainers, all interactions with this domain should be treated as potential compromise events requiring full incident response procedures.