en-ledger-wa[.]pages[.]dev

The domain en-ledger-wa.pages.dev was registered on April 27, 2026 and is currently active. It resolves to IP address 188.114.97.3, which is geolocated to Canada and is owned by Cloudflare, Inc. The site serves content over HTTPS with a Google Trust Services / WE1 certificate, employs HSTS, HTTP/3, and is hosted behind Cloudflare’s infrastructure (annabel.ns.cloudflare.com and seth.ns.cloudflare.com). An HTTP 200 response is returned for the request, and the page title observed is "Ledger Live Wallet — Secure Crypto Management," indicating a brand‑impersonation attempt targeting Ledger users. Security telemetry shows a Gridinsoft trust score of 0/100, the domain appears on one security blocklist, and it has been blocked by PhishDestroy. VirusTotal analysis flags the domain by 11 of 91 scanning engines. The risk level is assessed as high. While the exact malicious payload or credential‑harvesting mechanism has not been disclosed, the combination of brand‑specific page title, low trust score, and multiple vendor detections suggests a credible phishing operation. Defenders should block DNS resolution for en-ledger-wa.pages.dev, add the IP 188.114.97.3 to network deny lists, and monitor for any outbound connections to Cloudflare‑hosted services that reference Ledger branding. Continuous re‑evaluation is advised as additional indicators may emerge.