web-log-en-ldgr[.]pages[.]dev

This domain, web-log-en-ldgr.pages.dev, is actively engaged in brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as a legitimate Ledger login portal, using the page title 'Ledger - Secure Login' to deceive users into submitting sensitive credentials or recovery phrases. Current status remains active, posing a direct threat to individuals managing crypto assets through Ledger devices or services. Analysis indicates the domain was created on April 10, 2026, and is hosted via Cloudflare Pages infrastructure. It resolves to the IP address 172.66.44.60, geolocated to Cloudflare, Inc. in California. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of malicious domains leveraging legitimate CDN services to evade detection. As of the latest scan, 2 of 95 security vendors on VirusTotal have flagged this domain, while it appears on one additional security blocklist. The low detection rate suggests either recent deployment or the use of evasion techniques to bypass automated analysis. Infrastructure analysis reveals the domain is designed to harvest credentials or seed phrases under the guise of a secure login process. Users are advised to immediately block access to this domain and verify any Ledger-related communications through official channels only. Organizations should update web filtering rules to include this domain and its associated IP address. Individuals who may have interacted with this site should revoke any active sessions, rotate credentials, and monitor their Ledger device and associated accounts for unauthorized transactions. Due to the high-risk nature of crypto wallet impersonation, affected users are strongly encouraged to enable multi-factor authentication and review wallet recovery procedures.