log-usa-ledg-en[.]pages[.]dev

This domain, log-usa-ledg-en.pages.dev, is currently active and classified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The page presents itself as a legitimate login portal with the title "Safe Ledger Login Steps — Access Without Risks," designed to deceive users into submitting sensitive credentials or recovery phrases. Analysis indicates this infrastructure is explicitly crafted to exploit trust in the Ledger brand, likely for financial fraud or unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.104, geolocated to a data center in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging reputable certificate authorities to appear legitimate. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The low detection rate at present suggests the campaign may still be in an early or evasive phase, potentially avoiding broader scrutiny. The domain remains active as of this report, continuing to pose a significant risk to users unfamiliar with Ledger’s official authentication channels. Organizations and individuals are advised to block traffic to 172.66.47.104 and log-usa-ledg-en.pages.dev at the network perimeter. Users should verify domain authenticity by cross-referencing with Ledger’s official support documentation and enable multi-factor authentication where available. Security teams are encouraged to monitor for similar patterns, including Cloudflare-hosted subdomains with brand-related keywords and low initial detection counts, as these may indicate emerging phishing campaigns.