ledger-io-en[.]pages[.]dev

Analysis of the domain ledger-io-en.pages.dev indicates a confirmed brand-impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The domain, created on February 21, 2026, was hosted on Cloudflare infrastructure and resolved to the IP address 188.114.96.3, located in the United States under AS13335 (Cloudflare, Inc.). At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' a clear indicator of its malicious classification by the hosting provider. Infrastructure analysis reveals the use of Cloudflare nameservers (rafe.ns.cloudflare.com and toby.ns.cloudflare.com) and technologies including HSTS and HTTP/3, which are consistent with modern phishing campaigns leveraging CDN services to obscure origin servers.

The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain’s fraudulent intent, as phishing sites frequently employ valid certificates to appear legitimate. Detection data from security vendors supports the domain’s malicious classification. Nine of 93 vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, further corroborating its fraudulent nature.

The domain was also blocked by PhishDestroy, a specialized anti-phishing service, and classified as a crypto scam in threat intelligence feeds. While the domain is currently offline, defenders should treat any prior resolution or DNS queries for ledger-io-en.pages.dev as high-risk indicators. Organizations are advised to block the domain and its associated IP (188.114.96.3) at the network level, monitor for residual connections, and alert users who may have interacted with the site before its takedown.