get-ledgrre[.]pages[.]dev

Analysis of the domain get-ledgrre.pages.dev indicates a confirmed brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted under Cloudflare's infrastructure in Canada. The page title, 'Ledger Live — Secure Crypto Management,' directly mirrors Ledger's official branding, reinforcing the impersonation attempt. As of July 23, 2026, the domain has been taken offline, returning an HTTP 403 status, though its prior activity remains under scrutiny.

Detection metrics reveal moderate but notable concern: 15 of 91 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. The domain employs Cloudflare nameservers (phoenix.ns.cloudflare.com and quincy.ns.cloudflare.com) and utilizes HTTP/3 alongside HSTS, typical of modern phishing infrastructure leveraging Cloudflare's protective features to obscure origin details. The SSL certificate, issued by Google Trust Services (WE1), does not inherently indicate compromise but aligns with common phishing tactics to appear legitimate. Gridinsoft assigned a trust score of 0/100, further corroborating the domain's malicious classification.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, low trust scores, and detection by multiple security vendors confirms its fraudulent intent. Defenders are advised to block the domain and its resolving IP (188.114.97.3) at perimeter controls, monitor for related Cloudflare-hosted domains with similar naming patterns (e.g., 'ledger' misspellings), and alert users to potential Ledger-themed phishing attempts. No evidence of a broader campaign or associated malware distribution is currently linked to this domain.