ledger-com-on[.]pages[.]dev

This domain, ledger-com-on.pages.dev, is flagged as an active phishing site targeting users of Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site employs brand impersonation tactics, presenting a fraudulent setup page titled 'Getting Started with Ledger | Set Up Your Crypto Wallet' to deceive victims into entering sensitive credentials or recovery phrases. The threat type is classified as high-risk due to its direct targeting of financial assets and active status. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns to appear legitimate. Detection metrics show the domain is flagged by 2 out of 95 security vendors on VirusTotal and appears on one security blocklist. Google Safe Browsing does not currently list the domain, which may contribute to its evasion of widespread detection. As of the latest assessment, ledger-com-on.pages.dev remains active, though it is blocked by at least one security provider. The domain’s use of Cloudflare hosting and a valid SSL certificate increases its perceived legitimacy, posing a continued risk to unsuspecting users. Immediate mitigation actions include reporting the domain to additional blocklists and notifying the registrar for potential takedown. Users are advised to verify domain authenticity directly through official Ledger channels and avoid entering credentials on unverified platforms.