ldgr-wallet-web[.]pages[.]dev

This domain is flagged for elevated risk due to brand impersonation targeting Ledger, a hardware wallet provider. The threat type involves fraudulent replication of Ledger’s official setup interface, designed to deceive users into entering sensitive credentials or recovery phrases under the guise of device initialization. Analysis indicates the domain was operational until recently, with a page title explicitly mimicking legitimate Ledger onboarding: 'Ledger Wallet — Get Set Up Your Device.'

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 172.66.44.85, hosted by a content delivery network in Canada. It was registered through Cloudflare, Inc. on March 23, 2026, and is currently offline. The domain appears on one security blocklist, while VirusTotal reports 14 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. No additional subdomains or redirects were observed during active monitoring.

Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP across all network security controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and SSL certificate thumbprint. Users who may have interacted with the domain should be instructed to revoke any device authorizations, reset recovery phrases, and verify hardware wallet integrity through official channels. Security teams should monitor for similar impersonation patterns, particularly domains using 'ledger,' 'wallet,' or 'setup' in combination with content delivery network-hosted subdomains.