io-ledre[.]pages[.]dev

The domain io-ledre.pages.dev is actively impersonating Ledger, a well-known cryptocurrency hardware wallet brand. This phishing domain has been flagged by 4 out of 91 vendors on VirusTotal, indicating a moderate level of detection across security platforms. It is also listed on one public blocklist, specifically by PhishDestroy, highlighting its recognition as a threat.

Registered through Cloudflare, Inc., and hosted on an IP located in Canada (188.114.97.3), the domain uses SSL certification issued by Google Trust Services. This setup suggests an attempt to appear legitimate and secure to potential victims. The site's page title, "Ledger® | Ultimate Crypto Security | Start at Ledger.com/start," is designed to mislead users into believing they are interacting with the official Ledger website.

The phishing operation exploits the trust users place in Ledger's brand to potentially steal sensitive information such as recovery phrases or private keys. The domain's platform risk score of 76/100 further underscores the threat level it poses. Despite the relatively low number of VirusTotal detections, the presence of this domain on the PhishDestroy blocklist indicates its active role in ongoing phishing campaigns.

PhishDestroy's early detection of io-ledre.pages.dev on its creation date, May 1, 2026, demonstrates its capability to identify threats during the critical window before they are widely recognized by antivirus vendors. This proactive approach helps mitigate the risk posed by such phishing domains, which often exploit the delay in AV database updates to target unsuspecting users.