ledhgyta-zbxncg[.]pages[.]dev

The domain ledhgyta-zbxncg.pages.dev, impersonating Ledger, is flagged by 16 out of 91 vendors on VirusTotal. This phishing operation targets users by mimicking the Ledger Live interface, aiming to steal sensitive information. The domain was registered through Cloudflare, Inc., and hosted on an IP in Canada, also managed by Cloudflare.

PhishDestroy identified this threat on the same day it was created, April 26, 2026, showcasing the efficiency of our detection pipeline. Despite the domain's swift takedown, its brief online presence was enough to potentially deceive users unfamiliar with the genuine Ledger site. The platform risk score of 78 out of 100 indicates a high threat level, emphasizing the sophistication of the scam.

The SSL certificate issued by Let's Encrypt adds a layer of deceptive legitimacy, as victims might assume the site is secure. This tactic is common in phishing schemes, where attackers exploit the trust associated with SSL certificates. The domain's presence on one public blocklist, specifically PhishDestroy's, further highlights its malicious intent.

This case underscores the importance of early detection and rapid response in combating phishing threats. By capturing this domain in the critical window before widespread AV database updates, PhishDestroy helps protect users from emerging scams. The incident serves as a reminder of the ongoing need for vigilance against online impersonation attacks.