home-ledger-docs[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger hardware wallet users. The site presents a fraudulent login interface titled iTrust Login™ | Secure Sign-In, designed to harvest credentials or sensitive recovery phrases from victims under the guise of legitimate authentication. Analysis indicates the domain home-ledger-docs.pages.dev was registered through Cloudflare, Inc. on April 28, 2026, and currently resolves to the IP address 172.66.44.143, hosted on Cloudflare infrastructure in California. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal detection shows 1 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and remains active at the time of assessment. Mitigation requires immediate blocking of the domain and its resolving IP (172.66.44.143) across all network security controls. Users should be alerted to verify domain authenticity before entering credentials, particularly on pages mimicking Ledger’s official interface. Security teams are advised to monitor for related phishing attempts using the same SSL issuer or Cloudflare-hosted infrastructure, and to review logs for connections to 172.66.44.143 or domains with similar naming patterns. Ledger users should be directed to official channels only, ensuring multi-factor authentication is enabled where supported.