learn-live-s-wlt[.]pages[.]dev

Analysis indicates the domain learn-live-s-wlt.pages.dev is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on May 3, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, which is geolocated to Canada and associated with Cloudflare, Inc. infrastructure. Nameservers desi.ns.cloudflare.com and terin.ns.cloudflare.com further confirm Cloudflare as the hosting provider. The page title, 'Ledger® Live Wallet – Getting Started™ | Developer Portal,' explicitly references Ledger’s branding and its official software, Ledger Live, suggesting an intent to deceive users into believing the site is legitimate. Technical indicators reveal the use of HSTS, HTTP/3, and a valid SSL certificate issued by Google Trust Services (WE1), which may enhance the site’s perceived authenticity. However, the domain appears on at least one security blocklist, and eight of ninety-one security vendors on VirusTotal have flagged it as malicious. The Gridinsoft trust score of 0/100 corroborates these findings, classifying the domain as high-risk. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, recent registration, and detection by security vendors indicates a deliberate phishing campaign. Defenders should prioritize blocking this domain at the network level, particularly in environments where Ledger products are used. Monitoring for additional domains registered through Cloudflare with similar naming conventions (e.g., 'live,' 'wallet,' or 'ledger') may help identify related threats. Given the active status of the domain as of July 12, 2026, users should be advised to verify the authenticity of any Ledger-related communications or websites before interacting with them.