usb-ledger[.]pages[.]dev

PhishDestroy identifies usb-ledger.pages.dev as an active brand impersonation site targeting Ledger cryptocurrency wallet users. This domain employs a deceptive naming pattern (usb-ledger) to trick victims into downloading counterfeit wallet software under the guise of hardware device support. The threat leverages Cloudflare Pages hosting to obfuscate malicious infrastructure while maintaining a facade of legitimacy through Google Trust Services SSL certificates. Analysis indicates this campaign is currently under investigation with no antivirus detections as of the latest VirusTotal scan. This domain resolves to IP 188.114.97.3 and operates under Cloudflare, Inc. registration. The VirusTotal report currently shows 5/95 security vendor detections, indicating this impersonation site has evaded traditional detection mechanisms. The SSL certificate issued by Google Trust Services adds superficial credibility, while the Cloudflare Pages infrastructure provides hosting resilience. These characteristics suggest an advanced operation employing legitimate web services to distribute malicious content. Organizations should immediately block usb-ledger.pages.dev at network gateways and DNS levels. Users encountering this domain should avoid any downloads or interactions, as it currently distributes fake Ledger wallet software. Implement browser-based protections to block this domain and report it to Ledger's official abuse channels. Monitor for similar domain patterns incorporating 'ledger' or 'usb' in combination with top-level domains known for abuse.