pop-ledg-usa[.]pages[.]dev

Analysis confirms that pop-ledg-usa.pages.dev is an active phishing domain targeting Ledger hardware wallet users. The domain, registered on April 4, 2026, through Cloudflare, currently resolves to IP address 188.114.97.3 and presents a page titled 'Ledger Login Instructions — Verify & Connect Safely.' This title explicitly aligns with known brand impersonation tactics used to deceive users into entering sensitive wallet credentials or recovery phrases. As of July 12, 2026, the domain remains operational and is flagged by 10 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It is also blocked by at least one security blocklist and has received a trust score of 0/100 from Gridinsoft, reflecting high-risk classification. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages (pages.dev), a legitimate platform frequently abused for phishing due to its free SSL certificates and ease of deployment. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. While the exact content and functionality of the site have not been fully analyzed, the combination of brand impersonation, high-risk indicators, and active status strongly suggests it is designed to harvest Ledger wallet credentials or seed phrases. Defenders should treat this domain as a confirmed phishing threat. Immediate action is recommended, including blocking the domain and IP at network and endpoint levels, alerting users to the impersonation risk, and monitoring for credential theft attempts linked to this infrastructure. Further investigation into related domains or IPs may uncover additional malicious activity.