io-ledge-en[.]pages[.]dev

This domain, io-ledge-en.pages.dev, presents a high-risk brand impersonation threat targeting users of Ledger, a cryptocurrency hardware wallet provider. The site mimics legitimate Ledger onboarding pages with the title 'Get Started with Ledger - Secure Your Crypto Assets,' attempting to deceive visitors into entering sensitive credentials or installing malicious software. Given the domain's focus on cryptocurrency security, it likely aims to facilitate crypto asset theft, either through credential harvesting or direct wallet-draining malware distribution. Analysis indicates the domain was registered on September 2, 2020, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.166, associated with Cloudflare's infrastructure in the United States (AS13335). Security vendors on VirusTotal flag the domain as malicious, with 18 out of 95 detections confirming its phishing nature. It appears on three security blocklists and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as encrypted connections are commonly exploited in phishing campaigns to appear legitimate. Users who have visited io-ledge-en.pages.dev should immediately cease all interaction with the site. If credentials or recovery phrases were entered, affected parties must transfer assets to a new, secure wallet and revoke any connected permissions or authorizations. Devices used to access the domain should undergo a full security scan to detect potential malware. Additionally, users should monitor for unauthorized transactions and report the incident to relevant security teams or platforms tracking cryptocurrency fraud. Infrastructure analysis reveals the domain remains active, underscoring the need for continued vigilance and proactive blocking of this threat.