ledgr-login-access[.]pages[.]dev

Analysis indicates that the domain ledgr-login-access.pages.dev is an active credential phishing site targeting users of the Ledger hardware wallet platform. The domain was registered on April 4, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.123. The page title, 'Ledger Live Login – Fix App & Connection Issues,' explicitly impersonates Ledger’s official login portal, suggesting an intent to harvest user credentials under the pretext of troubleshooting. Infrastructure analysis reveals the domain is hosted on Cloudflare’s content delivery network, a common tactic to obscure origin servers and evade takedowns. The SSL certificate is issued by Google Trust Services, providing a superficial appearance of legitimacy. Detection data shows the domain is flagged by 8 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related indicators of compromise, such as the associated IP address. Given the domain’s registration age and continued activity, it is likely part of a broader campaign targeting cryptocurrency users. No evidence currently links this domain to a specific phishing kit or additional infrastructure, but ongoing monitoring is recommended to identify potential lateral movement or secondary payloads.