gets-ledg-us[.]pages[.]dev

PhishDestroy identifies active phishing infrastructure at domain gets-ledg-us.pages.dev impersonating Ledger cryptocurrency wallet services to harvest user credentials and sensitive financial data.

This domain was flagged as a generic phishing campaign on b11a2f seed infrastructure and remains active. VirusTotal analysis shows 0 detections from 95 vendors, indicating the domain is not yet widely recognized as malicious. The domain resolves to IP address 172.66.44.115, is registered through Cloudflare, Inc., and utilizes a legitimate Google Trust Services SSL certificate to enhance credibility. The current trust score across threat intelligence platforms remains undetermined due to the early stage of detection.

Current status indicates active operation with low detection rates, increasing the risk of successful user compromise. PhishDestroy recommends immediate domain blocking at network and endpoint levels, user awareness training regarding Ledger-themed phishing attempts, and enhanced monitoring for related infrastructure. Users should verify any Ledger-related communications through official channels and avoid interacting with suspicious links or entering credentials on untrusted pages.