ledger-login-cloud[.]pages[.]dev

The domain ledger-login-cloud.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.73 (AS13335, United States). The site serves HTTP 200 responses, presents a valid Google Trust Services / WE1 TLS certificate, and enforces HSTS while supporting HTTP/3, indicating a modern web stack. Security scoring from Gridinsoft is 0/100, and VirusTotal reports 11 of 93 scanners flagging the host, confirming malicious activity. The page title "Ledger Nano X: Mobile‑First Day‑to‑Day Use" suggests impersonation of the Ledger brand, and the listed scam types – seed_phish and wallet_connect_phish – indicate attempts to harvest cryptocurrency seed phrases or exploit wallet‑connect flows. The domain appears on one public blocklist and has been added to PhishDestroy’s blocklist, yet it remains active. Defenders should immediately block the fully qualified domain name and its associated IP address at perimeter firewalls and DNS resolvers, monitor for related CNAME or sub‑domain variations, and update endpoint protection rules to flag the identified scam categories. Continuous observation of Cloudflare‑hosted infrastructure and rapid ingestion of any newly reported indicators are recommended to mitigate further credential‑stealing campaigns.