helps-leger[.]pages[.]dev

The domain helps-leger.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. This scam specifically mimics Ledger's official interface to deceive users into entering sensitive recovery information, posing a risk of cryptocurrency theft. No drainer kit was identified, but the site was actively used for cryptocurrency-related fraud before being taken offline.

Technical indicators confirm the malicious nature of helps-leger.pages.dev. The domain was flagged by 1 of 95 VirusTotal security vendors, including Phishing Database, and appears on 1 security blocklist (PhishDestroy). It was registered through Cloudflare, Inc. on September 23, 2025, and resolved to the IP address 172.66.44.126, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Ledger® Start - Recovery'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with helps-leger.pages.dev should immediately revoke any token approvals associated with the site and transfer cryptocurrency funds to a new wallet. If recovery phrases or private keys were entered, consider the compromised wallet at high risk and cease using it. Change passwords for any accounts accessed after visiting the phishing site and enable two-factor authentication (2FA) where available. Report the domain to Ledger's official security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.