ledgerhardwarewallet[.]pages[.]dev

On July 23, 2026 the domain ledgerhardwarewallet.pages.dev was recorded as an inactive but previously active crypto‑related scam that impersonates the Ledger brand. The site was registered on February 21, 2026 through Cloudflare, Inc., using the authoritative name servers val.ns.cloudflare.com and jeff.ns.cloudflare.com. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.66.44.52, located in the United States and announced by ASN 13335, confirming that the attacker leveraged Cloudflare’s global network and its built‑in security features such as HSTS and HTTP/3. The site presented a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare”, served over TLS with a Google Trust Services WE1 certificate, indicating a valid HTTPS handshake but no indication of a proprietary keystore.

VirusTotal recorded 13 detections out of 95 scanning engines, and the domain appears on at least one external blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification. The HTTP response returned a 403 status code, which is consistent with the site being taken offline after detection. The listed scam type is “Crypto Scam” and the brand target is explicitly identified as Ledger, confirming a brand‑impersonation motive.

While the page content itself has not been captured, the combination of a brand‑specific target, a Cloudflare‑hosted phishing placeholder, multiple vendor detections, and a zero‑trust score provides strong evidence of a credential‑stealing or fund‑diversion operation aimed at Ledger users. Defenders should continue to block the domain at perimeter filters, update threat‑intel feeds with the indicator set (domain, IP, SSL certificate thumbprint, and name‑server pair), and monitor for any resurgence of similar sub‑domains under the pages.dev TLD.