home-ped-ger[.]pages[.]dev

This domain, home-ped-ger.pages.dev, is identified as an active brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site presents a fraudulent interface titled 'Ledger Start - Secure Your Crypto,' designed to deceive users into entering sensitive wallet credentials or recovery phrases. Infrastructure analysis indicates the absence of a known drainer kit signature, suggesting a manual credential-harvesting approach rather than automated token theft. The page mimics legitimate Ledger onboarding flows, increasing the likelihood of successful social engineering against cryptocurrency holders. Technical indicators confirm the domain's malicious nature. The domain resolves to IP address 188.114.97.3, hosted on infrastructure associated with Cloudflare, Inc. in California. Registered through Cloudflare on April 13, 2026, the domain remains undetected by Google Safe Browsing but is flagged by 7 out of 95 security vendors on VirusTotal. It appears on a single security blocklist and is currently blocked by PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while failing to validate the site's authenticity. As of the latest assessment, home-ped-ger.pages.dev remains active and unmitigated. No takedown actions have been observed, and the domain continues to resolve to its Cloudflare-hosted IP. Users are advised to verify domain authenticity through official Ledger channels before entering any credentials. Cryptocurrency holders should enable hardware-based two-factor authentication and avoid interacting with unsolicited wallet setup pages. Organizations monitoring cryptocurrency threats are recommended to add this domain to internal blocklists and monitor for related infrastructure reuse.