ex-x-duses[.]pages[.]dev

Analysis indicates that ex-x-duses.pages.dev is an active domain created on 22 January 2026 and hosted behind Cloudflare’s network (IP 188.114.96.3, located in Canada). The site serves content over HTTPS using a Google Trust Services WE1 certificate and enforces HSTS, while HTTP/3 is also enabled. The page title returned by the server is “Ledger® Live Wallet — Getting Started | official Ledger™”, directly referencing Ledger’s branding, which aligns with the reported brand‑impersonation and Crypto Scam classification. VirusTotal records show that one of ninety‑one scanners flagged the domain, and it is listed on a single security blocklist; PhishDestroy has already added it to its block list. Infrastructure evidence points to a Cloudflare‑only registration, with nameservers anastasia.ns.cloudflare.com and glen.ns.cloudflare.com, indicating that the operator is leveraging a reputable CDN to obscure origin. The low Gridinsoft trust score (0/100) further suggests malicious intent, though the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Uncertainty remains regarding the internal page content, user‑interaction flows, and any additional command‑and‑control infrastructure, as no visual analysis is available. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the resolved IP, and apply URL‑filtering rules for any URLs containing the “pages.dev” suffix that reference Ledger‑related keywords. Continuous re‑scanning with multi‑engine services is advised to capture any emerging detections.