en-ledgrr-logn[.]pages[.]dev

This domain was identified as a phishing site targeting users of Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger Live login portal, presenting a page titled 'Ledger Live Login | Secure Crypto Access' to deceive visitors into entering sensitive credentials or recovery phrases. If successful, attackers could gain unauthorized access to victims' crypto wallets, leading to theft of digital assets. The threat primarily exploits trust in the Ledger brand to execute credential harvesting or crypto drainer attacks. Analysis indicates the domain was registered through Cloudflare, Inc., and was created on April 03, 2026. At the time of investigation, the site resolved to the IP address 188.114.96.3 and used an SSL certificate issued by Google Trust Services, lending a false sense of legitimacy. Despite its appearance, the domain had zero detections on VirusTotal (0/95 engines) and a Gridinsoft trust score of 0/100, suggesting it had not yet been widely flagged by security vendors. The domain appeared on only one security blocklist, indicating limited prior detection. If you visited en-ledgrr-logn.pages.dev and entered any login credentials, recovery phrases, or personal information, immediate action is required. Disconnect the affected device from the internet to prevent further data transmission. Reset passwords for any accounts accessed through the site, prioritizing crypto wallets and email accounts linked to them. Use an official Ledger device or the verified Ledger Live application to check for unauthorized transactions. Monitor wallet addresses for suspicious activity and consider transferring assets to a new, secure wallet if compromise is suspected. Report the incident to Ledger’s official support channels and relevant cybersecurity authorities for further assistance.