ai-ledger-docs[.]pages[.]dev

This domain, ai-ledger-docs.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site displays the page title 'Ledger Crypto,' suggesting an attempt to deceive users into believing it is an official Ledger resource. No explicit crypto drainer kit signatures were identified, but the domain’s structure and branding align with known impersonation tactics used to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on August 19, 2025, and currently resolves to the IP address 172.66.47.204. VirusTotal detections show 9 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s active malicious classification suggests it may be detected under broader phishing or impersonation categories. As of the latest assessment, ai-ledger-docs.pages.dev remains active, posing an ongoing risk to users. Response actions should include immediate blocking of the domain and IP at the network level, alongside monitoring for related infrastructure (e.g., subdomains or newly registered lookalike domains). Users who may have interacted with the site should revoke any connected wallet permissions and scan systems for unauthorized access. The remaining risk is elevated due to the domain’s persistence, low detection rate among some vendors, and the potential for credential theft or malware distribution.