login-ledgre[.]pages[.]dev

PhishDestroy identifies login-ledgre.pages.dev as a fraudulent replica designed to mimic Ledger’s official login portal. This Cloudflare Workers-hosted domain poses an immediate credential theft risk to users lured by deceptive branding, such as phishing emails or fake ads, and should be treated as an active Ledger phishing site until further analysis confirms otherwise. The domain resolves to IP 172.66.47.197 and operates under Cloudflare, Inc., leveraging Google Trust Services SSL to enhance perceived legitimacy while evading early detection mechanisms. This domain was flagged with 0 detections out of 95 VirusTotal scans as of the latest intelligence, indicating it has slipped past standard antivirus and browser-based defenses. It is currently active and registered through Cloudflare’s infrastructure, which is commonly exploited by threat actors to host phishing content due to high availability and low friction. These characteristics align with the seed identifier 5efa47, supporting classification under brand impersonation with potential for rapid deployment across multiple attack vectors. If you visited login-ledgre.pages.dev or entered any credentials, immediately change your Ledger account password and enable two-factor authentication. Scan your device using reputable antivirus software and check your browser history for any unauthorized extensions or altered bookmarks. Report the domain to Ledger’s abuse team and your local cybercrime unit. Disable any saved passwords tied to this domain and monitor financial accounts for suspicious activity.