net-ldgr-wallet-live[.]pages[.]dev

The domain net-ldgr-wallet-live.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (IP 188.114.97.3, located in Canada). The site employed modern web technologies including HTTP/3 and HTTP Strict Transport Security (HSTS), and presented a valid SSL certificate issued by Google Trust Services under the WE1 designation. An HTTP request to the host returned a 403 status code before the site was taken offline. The page title observed during the brief live window read “Ledger Hardware Wallet – Protect Bitcoin, Ethereum,” directly referencing the Ledger brand and indicating a crypto‑wallet impersonation attempt.

Security‑vendor scanning on VirusTotal recorded 13 detections out of 94 scanners, and the domain appears on a single security blocklist. Independent analysis by Gridinsoft assigned a trust score of 0 / 100, and the phishing mitigation service PhishDestroy listed the domain as blocked. The infrastructure footprint is minimal: the domain uses Cloudflare’s default nameservers (izabella.ns.cloudflare.com and jasper.ns.cloudflare.com) and does not reveal additional hosting or service providers. Current intelligence classifies the activity as a crypto scam that impersonates Ledger hardware wallets.

No further content or credential‑capture mechanisms have been publicly disclosed, and the site’s offline status limits direct observation of malicious payloads. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of similar sub‑domains that reuse the “net‑ldgr‑wallet‑live” naming pattern. Threat‑intel feeds should be refreshed to capture any new detections, and organizations that use Ledger hardware wallets should issue user awareness advisories referencing the specific page title and domain to reduce the risk of credential compromise.