nav-ledgr-home[.]pages[.]dev

This domain, nav-ledgr-home.pages.dev, is flagged as a high-risk brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics legitimate Ledger login interfaces, presenting a page titled 'Ledger Login Access — Step-by-Step Security Tutorial' to deceive users into entering sensitive credentials or recovery phrases. The infrastructure is designed to facilitate unauthorized access to crypto wallets, a tactic consistent with crypto drainer operations observed in recent phishing campaigns. Infrastructure analysis reveals the domain was registered on April 04, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare’s network. Detection metrics show limited but targeted coverage, with 2 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging free certificates. No detections were reported in Google Safe Browsing at the time of analysis. As of the latest assessment, nav-ledgr-home.pages.dev remains active, posing an ongoing threat to users who may encounter it through phishing links or malvertising. The domain’s use of Cloudflare’s registrar and hosting services complicates takedown efforts, as such platforms are frequently exploited for their privacy protections and ease of deployment. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on all crypto-related accounts, and cross-reference official communications from Ledger’s verified channels. The remaining risk is classified as high due to the domain’s active status and direct targeting of cryptocurrency assets.