learns-ledgr-live-exp[.]pages[.]dev

This domain, learns-ledgr-live-exp.pages.dev, is a confirmed credential phishing site impersonating the Ledger brand. Registered on April 13, 2026, through Cloudflare, Inc., it remains active as of July 12, 2026, and resolves to IP 188.114.97.3 located in Canada (Cloudflare, Inc.). The page title, 'Ledger® Live — Login & Getting Started (Presentation)', confirms the impersonation of Ledger's legitimate login interface. Technical analysis reveals the use of HSTS, Cloudflare infrastructure, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal data shows 7 out of 94 security vendors flagging this domain as malicious, and it appears on at least one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, indicating high suspicion. Nameservers are elaine.ns.cloudflare.com and fattouche.ns.cloudflare.com. The exact content of the page has not been analysed, but based on the title and brand target, this site is designed to harvest credentials from Ledger users. Defenders should block this domain at the network and email gateway levels, and users who may have interacted with it should reset their Ledger Live credentials immediately. Infrastructure analysis indicates the domain leverages Cloudflare's edge services, likely to evade detection and geolocation-based blocking. The domain's creation date and continued HTTP 200 status suggest an active and potentially long-running campaign.