web-ledgr-wllet[.]pages[.]dev

Analysis of the domain web-ledgr-wllet.pages.dev indicates a high‑confidence brand‑impersonation campaign targeting Ledger users. The site was registered on March 23 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑hosted address 172.66.47.51, which is geolocated to Canada. DNS configuration lists the authoritative Cloudflare nameservers art.ns.cloudflare.com and ursula.ns.cloudflare.com, confirming the use of Cloudflare’s edge infrastructure. The TLS certificate is issued by Google Trust Services under the “WE1” identifier, a legitimate certificate authority, yet the presence of a valid certificate does not mitigate the malicious intent.

The page title returned by the server reads “Ledger Live | Secure Ledger Wallet Setup | ledger.com/start”, directly referencing Ledger’s official branding and suggesting a credential‑harvesting vector. HTTP response code 403 indicates the site is currently inaccessible, and the domain has been taken offline. Despite its offline state, the domain appears on the PhishDestroy blocklist and is flagged by 15 of 94 VirusTotal scanners, reflecting a consensus among security vendors that the domain is malicious. Additional infrastructure signals include enforcement of HTTP Strict Transport Security (HSTS) and support for HTTP/3, both typical of Cloudflare‑protected sites but irrelevant to the phishing assessment.

Gridinsoft assigns a trust score of 0 / 100, reinforcing the conclusion that the domain is untrusted. No further evidence, such as malware payloads or phishing page screenshots, is available in the current intelligence set. Consequently, defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation attempts, and educate Ledger users about the specific impersonation vector reflected in the page title. Ongoing vigilance is advised, especially given the recent registration date and the use of reputable hosting services to obscure malicious activity.