ledger-live-wal-let-9t6[.]pages[.]dev

Analysis of ledger-live-wal-let-9t6.pages.dev shows that the domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The authoritative nameservers are sandra.ns.cloudflare.com and vick.ns.cloudflare.com. The site served HTTPS using a certificate issued by Google Trust Services under the WE1 root, and the connection employed HSTS, HTTP/3, and Cloudflare edge services. An HTTP request returned status code 403 and the page title reported “Suspected phishing site | Cloudflare”, indicating that the hosting provider has already flagged the content.

The domain is listed on a single security blocklist and was blocked by PhishDestroy. VirusTotal scans recorded eight detections out of ninety‑three scanners, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The branding inference is explicitly stated as an impersonation of Ledger, classifying the campaign as a crypto‑related scam. The current operational status is offline, suggesting the site has been taken down, but the infrastructure components remain observable.

Uncertainty remains regarding the exact payload delivered to victims, as no visual or functional analysis of the landing page is available beyond the title. Defenders should continue to block the domain at DNS and proxy layers, update URL filtering rules to include the full hostname, and monitor for any newly registered subdomains under the same Cloudflare account. Additional telemetry such as network traffic logs and endpoint alerts should be correlated with the observed IP and certificate fingerprint to detect any residual attempts to reach the takedown host.