ledger-com-login[.]pages[.]dev

Analysis indicates that ledger-com-login.pages.dev is an active brand‑impersonation site targeting Ledger users. The domain was registered on September 19 2025 through a Cloudflare registrar and currently resolves to IP 172.66.44.92, a Canadian address associated with Cloudflare, Inc. HTTP requests return status 200 and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 authority. Observed technologies include HSTS, HTTP/3, and Cloudflare edge services. The authoritative nameservers are alec.ns.cloudflare.com and miki.ns.cloudflare.com. The page title “Ledger Login – Secure Access” aligns with the declared brand target Ledger and the scam type is identified as a crypto‑scam. Threat intelligence sources list the domain on one security blocklist and it is actively blocked by PhishDestroy. Google Safe Browsing flags it for SOCIAL_ENGINEERING, and VirusTotal reports 16 of 91 AV engines flagging the domain. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The risk level is high and the domain remains active. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no page content has been examined. Defenders should add the IP address and full domain to network‑level deny lists, monitor DNS queries for the domain, and enforce URL filtering based on the observed indicators. Continuous re‑evaluation is advised in case the infrastructure changes or additional detections emerge.