lern-wlt-en[.]pages[.]dev

Analysis of lern-wlt-en.pages.dev indicates active brand impersonation targeting Ledger. The domain was registered on April 30, 2026 and resolves to IP address 188.114.96.3, hosted by Cloudflare, Inc. DNS resolution uses Cloudflare nameservers mckinley.ns.cloudflare.com and trey.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services (WE1). HTTP response code is 200 and the server advertises HSTS and HTTP/3, confirming modern TLS configuration. The page title returned by the server is "Ledger® Live Wallet – Getting Started™ Developer Portal", directly referencing the Ledger brand and reinforcing the impersonation claim. Security telemetry shows a Gridinsoft trust score of 0/100 and 4 of 91 VirusTotal scanners flag the domain, while the site appears on one external blocklist and has been blocked by PhishDestroy. The infrastructure is typical of fast‑flux‑resistant phishing operations that leverage reputable cloud providers to gain trust. No additional content analysis is available; the exact page layout, form fields, or credential‑harvesting mechanisms have not been observed. Defenders should treat the domain as malicious, add it to URL filtering and DNS blocklists, and monitor for any related subdomains or similar page titles. Continuous observation of Cloudflare‑hosted IP ranges for new Ledger‑related impersonation attempts is recommended, as the attacker may reuse the same infrastructure for future campaigns.