getting-ledger-io[.]pages[.]dev

Analysis of the domain getting-ledger-io.pages.dev indicates a confirmed brand impersonation campaign targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.46.226, which is hosted on Cloudflare’s network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (james.ns.cloudflare.com and ainsley.ns.cloudflare.com), along with security technologies such as HSTS and HTTP/3, which are consistent with legitimate services but are frequently exploited by threat actors to lend credibility to phishing sites. At the time of assessment, the domain returned an HTTP 403 status, and its page title was explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting that Cloudflare’s internal systems had already flagged the resource as malicious.

This aligns with its presence on at least one security blocklist and its classification as a crypto scam in available threat intelligence. Detection engines on VirusTotal identified the domain as malicious, with 11 of 95 security vendors marking it as suspicious. Additional trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further corroborate its high-risk classification. The SSL certificate for the domain was issued by Google Trust Services (WE1), a legitimate certificate authority, which does not mitigate the domain’s malicious intent but may contribute to evading initial user suspicion.

While the exact content of the phishing page remains unanalyzed due to its offline status, the available evidence—including the domain name, brand target, and scam type—strongly suggests an attempt to deceive users into disclosing cryptocurrency wallet credentials or transferring funds under false pretenses. Defenders should treat this domain as a confirmed phishing resource and prioritize blocking it at the network and endpoint levels.