web-ledger-login-en[.]pages[.]dev

This domain, web-ledger-login-en.pages.dev, is flagged as a Ledger-brand impersonation site targeting cryptocurrency users. Analysis indicates it was registered on February 21, 2026, through Cloudflare, Inc., and was taken offline by July 23, 2026, returning an HTTP 403 status. The domain resolved to Cloudflare’s Anycast network (188.114.97.3, AS13335) and used Cloudflare nameservers (priscilla.ns.cloudflare.com, peter.ns.cloudflare.com). SSL certification was issued by Google Trust Services (WE1), and the site enforced HSTS and HTTP/3 protocols. Security vendors have consistently marked this domain as malicious.

Gridinsoft assigned a trust score of 0/100, Scamadviser rated it 1/100, and PhishDestroy blocked it. Fourteen of 93 security vendors on VirusTotal flagged the domain as phishing or fraudulent. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. The domain appears on at least one security blocklist, reinforcing its elevated risk level.

While the exact content of the site remains unanalyzed, the available evidence—including the domain name structure, registration details, and detection by multiple security vendors—strongly suggests it was designed to deceive Ledger hardware wallet users into disclosing sensitive credentials or transferring cryptocurrency. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS and network levels. Organizations using Ledger products should alert users to avoid any interaction with this domain or similar variations. Further investigation into the hosting infrastructure and associated threat actors is recommended.