en-us-liveledgr-learns[.]pages[.]dev

This domain, en-us-liveledgr-learns.pages.dev, is actively impersonating Ledger, a cryptocurrency wallet provider, as evidenced by the page title 'Ledger® Live: Secure Access to Your Wallet' and its classification as a brand impersonation scam. Registered on April 18, 2026, through Cloudflare, the domain resolves to IP 188.114.96.3, hosted under Cloudflare's infrastructure in Canada. The site employs Cloudflare nameservers (alex.ns.cloudflare.com, olga.ns.cloudflare.com) and supports HSTS and HTTP/3, which may complicate detection or takedown efforts. As of July 12, 2026, the domain returns an HTTP 200 status, indicating it is operational and serving content. It appears on one security blocklist (PhishDestroy) and is flagged by 12 of 94 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, further corroborating its malicious nature. Analysis indicates the domain is likely designed to harvest credentials or sensitive information from users attempting to access Ledger's legitimate services. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related infrastructure leveraging Cloudflare's platform. The SSL certificate, issued by Google Trust Services (WE1), does not provide assurance of legitimacy, as certificates are routinely issued for malicious domains. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, active status, and security vendor detections confirms its high-risk classification. No evidence suggests this domain is part of a broader campaign, but defenders should correlate with other Ledger-themed phishing domains for potential patterns.