home-ledgr-io[.]pages[.]dev

Analysis indicates that the domain home-ledgr-io.pages.dev is actively impersonating Ledger, a hardware wallet provider, as of July 14, 2026. The domain was registered on April 21, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. The page title, 'Official Site® | Ledger.com/Start® | Getting started,' explicitly mimics Ledger’s official onboarding process, suggesting an intent to deceive users into engaging with fraudulent content. Google Safe Browsing has flagged the domain under the category 'SOCIAL_ENGINEERING,' corroborating its malicious classification. Infrastructure analysis reveals the domain is hosted on Cloudflare Pages (pages.dev subdomain) and uses an SSL certificate issued by Google Trust Services, a common tactic to lend superficial legitimacy. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Despite these indicators, the domain has not been flagged by any vendors in VirusTotal scans as of the latest available data, though the absence of detections does not confirm safety. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and social engineering classification. Network-level blocking is recommended, along with monitoring for related subdomains or IPs associated with the same infrastructure. Further investigation into the domain’s content and potential distribution methods (e.g., phishing emails, malvertising) is advised, though no specific delivery vectors have been confirmed in available intelligence.