guide--ledgr-en[.]pages[.]dev

This domain, guide--ledgr-en.pages.dev, is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site replicates the official Ledger Start page, presenting users with a fraudulent interface titled 'Ledger Start — Securely Begin Your Crypto Journey.' Such infrastructure is commonly associated with cryptocurrency drainer kits designed to harvest recovery phrases, private keys, or execute unauthorized transactions under the guise of wallet initialization or firmware updates. Infrastructure analysis reveals the following technical indicators: the domain is hosted on Cloudflare Pages and resolves to IP address 188.114.97.3. It was registered on November 07, 2025, and holds an SSL certificate issued by Google Trust Services (WE1). The domain is currently detected by 11 out of 95 security vendors on VirusTotal and appears on one security blocklist. While Google Safe Browsing status is not explicitly stated, the presence of active detections and blocklist inclusion suggests ongoing malicious activity. As of the latest assessment, guide--ledgr-en.pages.dev remains active and unmitigated. No takedown or suspension actions have been observed, and the domain continues to resolve. Users encountering this domain are advised to cease interaction immediately, avoid entering any sensitive credentials, and report the URL to relevant security teams. The remaining risk is classified as high due to the domain's operational status, direct targeting of cryptocurrency assets, and lack of remediation. Organizations and individuals should update internal blocklists to include this domain and monitor for related infrastructure using the seed identifier 26b2df.