walet-ledgr-os[.]pages[.]dev

Analysis of walet-ledgr-os.pages.dev shows an active infrastructure used to impersonate the Ledger brand. The domain was registered on April 27, 2026 through Cloudflare, Inc. and is served from the Cloudflare network (IP 172.66.45.43, located in Canada). DNS resolution uses Cloudflare nameservers bruce.ns.cloudflare.com and cortney.ns.cloudflare.com. The site enforces HSTS, supports HTTP/3, and presents a Google Trust Services / WE1 SSL certificate, indicating a legitimate‑looking TLS layer. The HTTP response returns status code 200 and the page title observed is "Ledger Wallet – Getting Started | Developer Portal," directly referencing Ledger and confirming the brand‑impersonation intent. Security telemetry flags the domain as high‑risk: it appears on one blocklist, is blocked by PhishDestroy, and 11 of 91 VirusTotal scanners have flagged it. The Gridinsoft trust score of 0/100 further underscores malicious confidence. While the exact content of the page has not been examined, the combination of recent registration, targeted page title, and multiple detections points to a credential‑harvesting campaign aimed at Ledger users. Defenders should immediately block the domain at network perimeters, add it to URL filtering and email security policies, and monitor for similar sub‑domains using the same Cloudflare nameserver pattern. Ongoing threat‑intel feeds should be consulted for any emerging indicators related to Ledger impersonation, and incident response teams should be prepared to handle potential credential exposure reports from affected users.