ledzor-log-en[.]pages[.]dev

This domain, ledzor-log-en.pages.dev, is actively engaged in brand impersonation phishing targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as an official Ledger login portal, as evidenced by the page title "Login | Ledger® | Getting started." Analysis indicates this is a high-risk threat designed to harvest credentials or sensitive financial information from unsuspecting users. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, located in Canada. The domain is flagged by 3 of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which is consistent with Cloudflare-managed domains. Notably, the domain remains active despite these detections, suggesting ongoing malicious intent. Current status confirms the domain is still operational, posing an immediate risk to Ledger users. Organizations and individuals are advised to block the domain and IP address at the network level. Users should be alerted to verify the legitimacy of any Ledger-related login portals by cross-referencing official communication channels. Security teams are recommended to monitor for related domains using similar naming conventions (e.g., "ledzor," "log-en") and implement real-time threat intelligence feeds to detect emerging impersonation attempts.