learn-legdr-portal[.]pages[.]dev

learn-legdr-portal.pages.dev is currently active and hosts a page titled “Ledger Live Download | Crypto Wallet App | Ledger”. The site resolves to IP 172.66.46.240, which belongs to Cloudflare, Inc. and is located in Canada. DNS is served by candy.ns.cloudflare.com and wells.ns.cloudflare.com, indicating the domain is registered through Cloudflare. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 hierarchy and enforces HTTP Strict Transport Security. Traffic is delivered over HTTP/3, confirming modern Cloudflare edge configuration. The page returns HTTP 200, suggesting the content is being served without error. The domain was created on 30 April 2026, and security analysis shows a Gridinsoft trust score of 0/100. VirusTotal scans report that 4 of 91 security vendors flagged the domain, and the domain appears on a single blocklist, where it has been flagged by PhishDestroy. The combination of a brand‑specific page title, the use of Ledger’s brand name, and the low trust score indicate a high‑risk brand‑impersonation campaign targeting Ledger users. However, no malicious payloads, credential‑stealing forms, or download links have been observed in the available data, leaving the exact malicious intent uncertain. Defenders should block traffic to the domain at network perimeters, monitor DNS queries for the domain and its associated Cloudflare nameservers, and add the domain to threat‑intel feeds. Continuous re‑analysis of the site’s content is recommended to detect any future changes that could introduce credential‑phishing or malware distribution.