logen-lgar-docs[.]pages[.]dev

The phishing domain logen-lgar-docs.pages.dev targets Ledger users, attempting to deceive them into divulging sensitive information. This site is hosted on Cloudflare Pages with an IP located in Canada, specifically under the organization CloudFlare, Inc. The domain has been flagged by one security vendor on VirusTotal, and it is also listed on the PhishDestroy public blocklist.

The site uses a title mimicking Ledger's branding, "Ledger®Login* - Getting Started™*", to lure users into believing they are accessing a legitimate service. This tactic is a common method in phishing schemes, where attackers replicate the appearance of trusted brands to harvest credentials or other sensitive data. The domain's SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy.

Despite only one detection on VirusTotal, the presence of this domain on a public blocklist highlights its potential risk. Phishing domains often exploit the time lag between their creation and when they are flagged by antivirus databases. PhishDestroy's monitoring systems capture these threats in their early stages, providing crucial alerts before they become widely recognized. The domain's active status indicates the ongoing nature of this threat, emphasizing the need for awareness among potential targets.