help-io-tzor[.]pages[.]dev

This domain, help-io-tzor.pages.dev, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as indicated by the page title 'Ledger Wallet – Secure Your Crypto with Style' and the brand target field. Registered on April 6, 2026, through Cloudflare, the domain resolves to IP 188.114.96.3 (Cloudflare, Inc., CA) and uses nameservers maciej.ns.cloudflare.com and sasha.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and the domain returns an HTTP 200 status, suggesting it is operational. It appears on one security blocklist and is flagged by 2 of 94 vendors in VirusTotal, though the specific detection context is not detailed. Infrastructure analysis reveals the domain is hosted behind Cloudflare, a common tactic to obscure origin servers and evade takedowns. The registration date (three months old) does not indicate long-term persistence, but the domain’s active status and brand impersonation pose a high risk. Defenders should treat this as a confirmed phishing resource targeting Ledger users, likely designed to harvest credentials or distribute malicious payloads. Immediate blocking at the DNS or proxy level is recommended, along with monitoring for related domains using the same Cloudflare nameservers or IP range. Further analysis of the page content is required to determine the exact phishing mechanism, but the brand impersonation and active status justify proactive mitigation.