ledger-login-bmr[.]pages[.]dev

Analysis of ledger-login-bmr.pages.dev, observed on 24 July 2026, shows a high‑risk brand‑impersonation infrastructure targeting Ledger users. The domain was registered through Cloudflare, Inc. on 21 February 2026 and resolves to IP 172.66.44.87, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a Cloudflare‑issued TLS certificate signed by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3. An HTTP request returns status 403 and the page title is “Suspected phishing site | Cloudflare”.

VirusTotal records indicate that 11 of 93 scanned security vendors flagged the domain as malicious, and the Gridinsoft trust score is 0 / 100. Google Safe Browsing lists the site under social‑engineering threats, and it appears on a single external blocklist, currently blocked by PhishDestroy. The nameservers ulla.ns.cloudflare.com and james.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. The intelligence tags the campaign as a crypto‑scam that impersonates the Ledger brand.

No additional content analysis is available beyond the title, so the precise phishing payload remains unknown. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint layers, add the domain to URL filtering rules, and monitor for any related sub‑domains that may be registered under the same nameservers. Continuous threat‑intel feeds should be consulted for new indicators, and any credential‑dumping activity targeting Ledger accounts should be investigated in light of this infrastructure.