explore-ledgr-en[.]pages[.]dev

PhishDestroy identifies explore-ledgr-en.pages.dev as a credential-harvesting landing page currently impersonating a popular cryptocurrency wallet service. The site is hosted on Cloudflare Pages and resolves to IP 188.114.96.3, where it serves a spoofed login form designed to trick users into surrendering their recovery phrases or private keys. Security telemetry shows zero detections on VirusTotal across 95 engines, and the domain is still absent from major blocklists, indicating it remains under active investigation.

Technical indicators align with a classic phishing campaign: registration through Cloudflare, Inc., an active SSL certificate issued by Google Trust Services, and a fresh infrastructure footprint pointing to recent deployment. The absence of detection signals poses a heightened risk to crypto holders who may mistake the page for an official Ledger support domain. Attack infrastructure follows a low-profile strategy, leveraging a Pages.dev subdomain to evade legacy filtering while providing the attacker with rapid deployment and evasion capabilities.

If you visited explore-ledgr-en.pages.dev—especially if you entered any wallet recovery phrases or credentials—assume compromise immediately. Disconnect any affected devices from the internet, revoke exposed keys in a separate, clean environment, and transfer remaining assets to a newly generated wallet. Report the incident to the real Ledger support channel and consider scanning your system with reputable anti-malware tools. Monitor blockchain addresses linked to the exposed keys for any unauthorized transactions.