ledgrd-o-es[.]pages[.]dev

The domain ledgrd-o-es.pages.dev was registered on March 24, 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.44.76, located in Canada. It is served by the Cloudflare nameservers jillian.ns.cloudflare.com and rory.ns.cloudflare.com and presents a valid SSL certificate issued by Google Trust Services under the WE1 designation. The site returns HTTP 200 and advertises HSTS, Cloudflare protection, and HTTP/3 support. The page title "Ledger® Live: Login | Your Wallet" aligns with a brand‑impersonation campaign targeting Ledger users. Threat intelligence shows the domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal analysis recorded three detections out of ninety‑four scanners, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. The risk level is classified as high and the campaign remains active. Defenders should block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP, and update email filtering rules to catch references to Ledger login prompts. Because the site uses legitimate Cloudflare infrastructure, traditional IP‑based blocking may generate false positives; therefore, correlation with the specific host header and page title is recommended. Continuous re‑scanning is advised to capture any changes in the underlying payload or hosting configuration.