Google Sites /view/ page impersonating Ledger wallet
Detects network navigation to Google Sites pages that match patterns associated with known Ledger-impersonating phishing campaigns. These sites are often reached through redirect chains involving Google Ads, cloud storage, and rotating domains.
Microsoft Sentinel (KQL)
