login-ledgr-io[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting Ledger. Analysis of known intelligence shows the domain login-ledgr-io.pages.dev was registered on April 6, 2026, through Cloudflare, Inc., and resolves to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services. The page title is 'Ledger Login Onboarding — Best Practices for New Users,' which directly references the Ledger brand. VirusTotal reports 13 of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. PhishDestroy has blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating high suspicion. The domain remains active as of the report date. Defenders should block access to this domain at the network level, as it is actively used for phishing against Ledger users. Users who have interacted with this site should change their Ledger credentials immediately and enable two-factor authentication. The exact phishing kit or method used is not yet analyzed, but the domain's infrastructure and content are consistent with credential theft. No further details about the server location or additional associated IPs are available in the current intelligence. Monitoring for related subdomains or variations is recommended.