lexger--login[.]pages[.]dev

Analysis of lexger--login.pages.dev confirms it as an active phishing domain targeting Ledger hardware wallet users. The domain, registered on March 29, 2026, through Cloudflare, hosts a page titled 'Ledger Login | Getting started™ with Ledger,' directly impersonating the official Ledger authentication portal. Infrastructure analysis reveals the site resolves to 188.114.97.3 and employs Cloudflare-hosted infrastructure, including HSTS and HTTP/3 protocols, alongside a Google Trust Services SSL certificate. While the domain appears on one security blocklist and is flagged by 12 of 95 vendors in a recent scan, its Gridinsoft trust score of 0/100 further supports its malicious classification. The page content has not been fully analyzed, but the combination of brand impersonation, recent registration, and detection by multiple security vendors indicates a high-risk credential harvesting operation. Defenders should treat this domain as confirmed malicious and prioritize blocking access at the DNS or network level. The use of Cloudflare's pages.dev subdomain suggests the attacker may leverage legitimate hosting services to evade detection, a common tactic in phishing campaigns. No evidence currently links this domain to a specific phishing kit or broader campaign, but its continued activity as of July 12, 2026, warrants immediate mitigation.