learn-ledger-log-in[.]pages[.]dev

The domain learn-ledger-log-in.pages.dev, which impersonates the cryptocurrency company Ledger, is flagged by 13 out of 93 vendors on VirusTotal. Despite being taken down, it previously posed a significant threat by attempting to deceive users into divulging sensitive information related to their cryptocurrency wallets. This domain was registered with Cloudflare, Inc. and hosted on an IP address located in the United States.

The phishing operation targeted Ledger users, leveraging the brand's credibility to lure victims into entering their login credentials on a fake login page. The domain's SSL certificate was issued by Google Trust Services, adding a layer of perceived legitimacy to the fraudulent site. The platform risk score for this domain was notably high at 78 out of 100, indicating a substantial threat level during its active period.

PhishDestroy added this domain to its blocklist, marking it as a known threat. The rapid detection and subsequent takedown highlight the effectiveness of threat intelligence efforts in mitigating potential damage. However, the incident underscores the ongoing risk posed by phishing domains, particularly those targeting the cryptocurrency sector. The domain's creation in September 2025 and detection in February 2026 suggest it was active for several months before being identified and neutralized.