ledger-hardwere--wallet-usa[.]pages[.]dev

Analysis of ledger-hardwere--wallet-usa.pages.dev indicates an active crypto‑drainer campaign. The domain is hosted behind Cloudflare, Inc., using the authoritative name servers gene.ns.cloudflare.com and simon.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which is the sole hosting endpoint observed.

The site has been added to one external security blocklist and is listed as blocked by the PhishDestroy service, confirming that defensive feeds have flagged it as malicious. VirusTotal reports that seven out of ninety‑one scanning engines have generated detections for the domain, demonstrating modest but notable consensus among malware‑analysis tools. No additional public telemetry such as Safe Browsing, OTX, or SSL certificate details are presently available.

The limited detection footprint suggests the infrastructure is relatively new or lightly distributed, yet the presence on blocklists and multiple vendor detections underscores a non‑trivial threat. Defenders should continue to deny any network traffic to 188.114.97.3, update intrusion‑prevention signatures to include the domain, and monitor for related cryptocurrency transaction patterns. Ongoing observation of the domain’s DNS records and blocklist status is recommended to capture any expansion of the campaign.