ledger-wallet-hardware-was[.]pages[.]dev

ledger-wallet-hardware-was.pages.dev was observed on July 23 2026 as an offline site that mimics Ledger hardware wallet branding. The domain was registered on February 21 2026 through Cloudflare, Inc. and is hosted on Cloudflare's network (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers ben.ns.cloudflare.com and jewel.ns.cloudflare.com. The TLS certificate is issued by Cloudflare TLS Issuing ECC CA 3, confirming the use of Cloudflare’s SSL infrastructure. HTTP requests return a 403 status code, indicating access denial, but the page title retrieved earlier reads “Ledger Hardware Wallet – Protect Your Crypto with a Trusted Device,” which aligns with the reported scam type of wallet/seed phishing and the impersonation of the “base” brand.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already taken the site offline. VirusTotal analysis reports that 10 of 93 scanned security vendors flag the domain as malicious, reinforcing the suspicion of a phishing campaign. No additional intelligence such as OTX or Safe Browsing entries is currently available. Uncertainty remains around the exact content served to victims, as the site is currently inaccessible and only the page title is known.

The lack of further public reports limits the ability to assess the scale of the campaign or the specific phishing payloads used. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host IP or related Cloudflare‑hosted subdomains, and update endpoint detection rules with the observed VirusTotal vendor flags. Incident response teams should also advise users to verify authentic Ledger communications through official channels and to avoid entering seed phrases on any site that does not belong to ledger.com.