start-nav-ledger-logn[.]pages[.]dev

This domain, start-nav-ledger-logn.pages.dev, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The site presents itself as an official Ledger login portal, specifically designed to harvest user credentials or facilitate unauthorized access to crypto wallets. As of the latest analysis, the domain remains operational and continues to pose a significant threat to users unaware of its fraudulent nature. Analysis indicates the domain was registered through Cloudflare, Inc. on April 21, 2026, and currently resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare's infrastructure. The domain appears on one security blocklist and has been flagged by 11 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate in origin, is being exploited to lend an air of authenticity to the malicious site. The page title, 'Ledger Login: Most Secure Crypto Wallet App | Ledger - Official,' directly mimics Ledger's branding to deceive visitors. The current status of this domain is active, and its infrastructure analysis reveals a high-risk profile due to its direct impersonation of a trusted cryptocurrency service provider. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to include its IP address (188.114.96.3). Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials, and monitor their accounts for unauthorized transactions. Security teams are encouraged to conduct retrospective analysis to identify any prior exposure to this domain within their environments.