ledger-wallet--io[.]pages[.]dev

On July 24, 2026, analysts identified the domain ledger-wallet--io.pages.dev as a high‑risk brand‑impersonation site targeting Ledger customers. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.77 located in the United States under ASN 13335. DNS resolution is served by malcolm.ns.cloudflare.com and hera.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that the content is currently inaccessible; the domain is reported as taken offline.

Google Safe Browsing has flagged the domain for social engineering, and the same classification appears in the single blocklist that currently lists the site. PhishDestroy has also blocked the domain, and 14 of 95 VirusTotal scanners have raised detections, reflecting a consensus among multiple security vendors that the domain is malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of severe risk. The SSL certificate is issued by Google Trust Services under the WE1 label, which is typical for Cloudflare‑proxied sites but does not mitigate the underlying impersonation.

The observed technologies—HTTP/3, HSTS, and Cloudflare CDN—are consistent with a modern hosting setup often leveraged by threat actors to increase reliability and evade simple network‑level blocks. While the exact phishing page content has not been captured, the combination of brand impersonation, crypto‑scam labeling, and the presence of a Cloudflare‑protected front page strongly suggests an attempt to harvest Ledger credentials or lure victims into cryptocurrency fraud. Defenders should add ledger-wallet--io.pages.dev to blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce strict outbound filtering for connections to the 172.66.44.77 IP address.