faq-ledger-com[.]pages[.]dev

The domain faq-ledger-com.pages.dev has been identified as a high-risk brand impersonation threat targeting Ledger. The site is currently offline, but it was previously flagged for phishing activities.

Infrastructure analysis reveals that faq-ledger-com.pages.dev was registered through Cloudflare, Inc. and resolves to the IP address 172.66.44.215, which is located in the United States under the AS13335 Cloudflare, Inc. network. The domain was created on September 02, 2020, and is protected by an SSL certificate issued by Google Trust Services / WE1. Analysis indicates that the domain has been flagged by 15 out of 95 security vendors on VirusTotal, and it appears on 1 known security blocklist. Google Safe Browsing also identifies this domain as a phishing threat. The domain was taken offline and is blocked by PhishDestroy.

Given the current offline status of the domain, it is recommended that continuous monitoring be implemented to detect any future attempts to reactivate the site. Additionally, users should be educated to recognize and avoid phishing sites impersonating reputable brands like Ledger. Security teams should ensure that all relevant security blocklists and vendor flags are integrated into their threat detection systems to mitigate potential risks.