sup-hrdwre-wallet[.]pages[.]dev

Analysis of sup-hrdwre-wallet.pages.dev indicates an active crypto‑related impersonation campaign targeting Ledger customers. The domain was registered on March 24, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3, which is geo‑located to Canada. DNS resolution uses the Cloudflare nameservers archer.ns.cloudflare.com and nancy.ns.cloudflare.com, and the site enforces HSTS and HTTP/3, confirming the use of Cloudflare’s security stack. The SSL certificate is issued by Google Trust Services under the WE1 identifier, providing a valid HTTPS connection despite the malicious intent.

The page title returned by the server reads "Ledger Hardware Wallet – Best Crypto Cold Storage Solution 2025," directly referencing the Ledger brand and suggesting a crypto‑wallet offering. HTTP responses return a 403 status, and the site is presently taken offline, as indicated by the status field. Reputation services show a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 31 / 100, both reflecting a high likelihood of fraud. VirusTotal scans flagged the domain in 14 of 94 security vendor engines, and the domain appears on a single security blocklist.

PhishDestroy has also listed the domain as blocked. The campaign is classified as a Crypto Scam, with the impersonated brand explicitly identified as Ledger. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the observed indicators, and monitor for any resurgence of the domain or related subdomains. Additional investigation is limited to the metadata reported; the actual page content has not been captured, leaving the precise phishing payload and user‑interaction details unknown.