guidfe-legor[.]pages[.]dev

This domain, guidfe-legor.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a provider of cryptocurrency hardware wallets. Analysis confirms the domain is actively hosting phishing content designed to deceive users into disclosing sensitive wallet credentials or installing malicious software under the guise of a legitimate Ledger setup process. The page title, 'Get Started with Ledger – Trusted Crypto Wallet Setup,' directly mimics official Ledger branding to enhance credibility and lower user suspicion. Infrastructure analysis reveals the domain was registered on April 24, 2026, through Cloudflare Pages, a platform commonly abused for rapid deployment of phishing sites. It resolves to the IP address 172.66.44.104, hosted by Cloudflare, Inc. in California. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not validate the site's content. Only 2 of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating low initial detection rates. The domain appears on one security blocklist and remains unblocked by most major security providers, increasing its potential reach. Current status indicates the domain is still active and poses a significant risk to users unfamiliar with Ledger’s official domains. Organizations and individuals are advised to block the domain at the network level and add 172.66.44.104 to firewall deny lists. Users should verify the legitimacy of any Ledger-related site by cross-referencing with the official ledger.com domain and checking for HTTPS and correct spelling. Security teams are encouraged to monitor for additional domains using the seed pattern 'a842e5' and similar Cloudflare Pages infrastructure for related threats.