localedger-com[.]pages[.]dev

This domain, localedger-com.pages.dev, operates as an active brand impersonation phishing site targeting users of the Ledger hardware wallet ecosystem. Analysis indicates the site mimics legitimate Ledger services by presenting a deceptive interface titled 'LocaLedger — Personal Finance, Offline-First,' designed to harvest cryptocurrency wallet credentials and seed phrases. The threat actor employs social engineering tactics to trick victims into connecting their wallets, enabling unauthorized transactions and asset theft through crypto drainer scripts embedded in the page infrastructure. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered through Cloudflare, Inc. on April 06, 2026, and currently resolves to the IP address 172.66.47.46, geolocated to California under Cloudflare's network. Security vendors have flagged the domain with 1 detection out of 95 on VirusTotal, while it appears on a single security blocklist. The site employs a Let's Encrypt SSL certificate (serial number E7) to present a false sense of legitimacy, a common tactic in phishing campaigns to evade user suspicion. Users who have visited localedger-com.pages.dev should immediately revoke any wallet connections made through the site and transfer assets to a new wallet using a clean device. It is critical to monitor all connected wallets for unauthorized transactions and update security configurations, including two-factor authentication and hardware wallet firmware. Victims should report the incident to relevant blockchain security teams and consider filing reports with cybercrime authorities to assist in tracking the campaign's infrastructure.