tags-lic-ledger[.]pages[.]dev

Analysis of tags-lic-ledger.pages.dev indicates an active high‑risk brand‑impersonation campaign targeting Ledger. The domain was registered on April 30, 2026 and resolves to IP 172.66.46.222, which is hosted by Cloudflare, Inc. in Canada. DNS is served by dave.ns.cloudflare.com and jean.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc. The site presents a page title identical to the official Ledger offering – "Ledger Wallet - Hardware Crypto Wallet | Ledger Live Portfolio …" – reinforcing the impersonation claim. TLS is provided by Google Trust Services under the WE1 certificate, and the server advertises HSTS and HTTP/3, confirming modern web security configurations. VirusTotal scans show 13 of 91 security vendors flag the domain, and the Gridinsoft trust score is 0/100, reflecting a malicious reputation. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy filtering service. While the content of the page has not been directly examined, the combination of brand‑specific title, recent registration, and multiple vendor detections strongly suggests a phishing or credential‑harvesting intent. Defenders should enforce network‑level blocking of tags-lic-ledger.pages.dev, monitor DNS queries for the associated IP range, and update endpoint protection signatures to include the observed indicator set. Ongoing surveillance is recommended to detect any potential payload delivery or credential capture activity originating from this infrastructure.