ledgers-wallet[.]pages[.]dev

The domain ledgers-wallet.pages.dev was identified on 24 July 2026 as a brand‑impersonation site targeting Ledger users. Registration records show it was created on 2 September 2020 and is hosted through Cloudflare, Inc., using the authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. The domain resolves to IP address 172.66.44.236, an address owned by AS13335 Cloudflare, Inc. in the United States. An HTTPS connection is presented with a certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS chain despite the malicious intent.

The web server returned HTTP status code 403, and the page title reported by the host is "Suspected phishing site | Cloudflare," which aligns with the observed brand‑targeting behavior. Technical fingerprints include enforcement of HSTS, deployment of Cloudflare services, and support for HTTP/3. Reputation checks recorded a Scamadviser trust score of 10 out of 100 and a Gridinsoft score of 0 out of 100, both reflecting a high risk posture. VirusTotal analysis flagged the domain in 10 of 93 security vendor scans, and the site appears on a single external blocklist.

It has also been listed by PhishDestroy as blocked. The site is currently marked offline, and no additional content beyond the page title has been publicly disclosed. Defenders should continue to block the domain and its associated IP address, incorporate the domain into DNS filtering and URL reputation services, and monitor for any re‑registration attempts or variants that reuse similar naming patterns. Given the confirmed impersonation of Ledger and the crypto‑scam classification, heightened monitoring of related credential‑capture campaigns is recommended.