logen-ledgar[.]pages[.]dev

The domain logen-ledgar.pages.dev was identified as a phishing resource specializing in brand impersonation, specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic legitimate Ledger login portals, as evidenced by the page title 'Getting started™ Ledger® Login.' The domain is currently offline, though prior activity posed an elevated risk to users by attempting to harvest sensitive credentials. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 6, 2026, and resolved to the IP address 188.114.96.3. Detection metrics indicate the domain was flagged by 12 of 95 security vendors on VirusTotal, while only appearing on a single security blocklist. Additional technical indicators include a Gridinsoft trust score of 0/100, the presence of HSTS, Google Analytics, and Cloudflare technologies, and an SSL certificate issued by Google Trust Services. The use of HTTP/3 further suggests an attempt to evade traditional detection mechanisms by leveraging modern web protocols. Current status confirms the domain has been taken offline, mitigating immediate threats to end users. However, the infrastructure and tactics observed align with persistent phishing campaigns targeting cryptocurrency-related services. Organizations and individuals are advised to monitor for similar domains registered under Cloudflare or resolving to the same IP range. Users should verify domain authenticity before entering credentials, particularly on pages mimicking financial or cryptocurrency platforms. Security teams are recommended to update blocklists with the domain and associated IP, while also conducting retrospective analysis to identify potential prior exposure.