support-en-ledgen[.]pages[.]dev

This domain is classified as a high-risk brand impersonation threat targeting Ledger, a hardware wallet provider. The site hosts a fraudulent onboarding page titled 'Ledger Start - Getting Started Ledger,' designed to harvest cryptocurrency wallet credentials, recovery phrases, or personal authentication details from unsuspecting users. Analysis indicates the domain is actively exploiting trust in Ledger’s official support infrastructure to facilitate unauthorized access to digital assets. Infrastructure analysis reveals the domain support-en-ledgen.pages.dev was registered on April 04, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.134, located in Canada. The domain is flagged by 12 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing pages. Despite its recent creation, the domain remains operational and unmitigated. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (172.66.44.134) at the firewall or DNS level to prevent access. Users who may have interacted with the site should assume credential compromise and initiate recovery protocols, including revoking access to linked wallets, generating new recovery phrases, and monitoring for unauthorized transactions. Security teams should prioritize monitoring for related domains using similar naming conventions (e.g., ledgen, support-en) or Cloudflare Pages infrastructure, as threat actors frequently reuse hosting providers for phishing campaigns.