ledger-connect[.]pages[.]dev

The domain ledger-connect.pages.dev is an active phishing site engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. This site poses an elevated risk by attempting to deceive users into disclosing sensitive information or transferring cryptocurrency under false pretenses. As of the latest verification, ledger-connect.pages.dev remains operational and does not employ a known drainer kit, but its fraudulent nature is confirmed through multiple security validations.

Technical indicators reveal that ledger-connect.pages.dev is flagged by 11 of 95 security vendors on VirusTotal, including alphaMountain.ai, BitDefender, and CyRadar. The domain is registered through Cloudflare, Inc., with a creation date of September 08, 2025, and resolves to the IPv6 address 2606:4700:310c::ac42:2f95, hosted on Cloudflare's US infrastructure (AS13335). It appears on two security blocklists, PhishDestroy and PhishingDB, though Google Safe Browsing has not yet flagged it. No SSL certificate is present, and the observed page title is 'Suspected phishing site | Cloudflare'.

Users who may have interacted with ledger-connect.pages.dev should immediately revoke any token approvals granted to suspicious contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts, enable two-factor authentication, and monitor for unauthorized transactions. Report the phishing domain to Ledger's official security team, as well as to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.