wallet-ledger-live-learn[.]pages[.]dev

The domain wallet-ledger-live-learn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to IP address 172.66.47.110, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but offering no protection against the underlying malicious content. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, reflecting extreme suspicion. An HTTP request returns a 403 status code, suggesting that the resource is currently inaccessible; the domain’s status is reported as taken offline.

VirusTotal analysis shows that nine of ninety‑three security vendors flagged the domain, confirming that multiple detection engines consider it malicious. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. The page title returned from the server is "Ledger Live Wallet — Secure Crypto & NFT Management," which aligns with the reported scam type of wallet/seed phishing and indicates an attempt to impersonate Ledger’s branding. DNS resolution uses Cloudflare nameservers lila.ns.cloudflare.com and jakub.ns.cloudflare.com, and the site employs HSTS, HTTP/3, and Cloudflare as its underlying technology stack.

Impersonation is noted as targeting the brand "across," suggesting a broad campaign against multiple brands rather than a single targeted entity. Defenders should immediately add the domain and its resolving IP to outbound and inbound blocklists, enforce DNS filtering for the associated nameservers, and monitor for any resurgence of the domain or related subdomains.