ledger-wellet[.]pages[.]dev

ledger-wellet.pages.dev was observed hosting a page titled “Suspected phishing site | Cloudflare” and is classified as a Ledger brand impersonation. The domain was created on 21 February 2026 and is currently taken offline, with the HTTP response returning status 403. DNS resolution points to 172.66.47.99, an address owned by AS13335 (Cloudflare, Inc.) located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate chain. Service headers indicate the presence of HSTS, Cloudflare edge services and HTTP/3 support, consistent with typical Cloudflare‑hosted infrastructure.

Reputation services assign very low trust scores: Scamadviser reports 10 / 100, Gridinsoft 0 / 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 11 of 93 scanned engines flagged the domain, reinforcing the malicious assessment. The site is listed as a “Crypto Scam” and has been blocked by PhishDestroy. Registration was performed through Cloudflare, Inc., and the authoritative nameservers are weston.ns.cloudflare.com and nancy.ns.cloudflare.com.

Evidence confirms that the domain is being used to impersonate Ledger, though the specific content of the landing page has not been captured in this report. The combination of a recent registration, low reputation scores, multiple vendor detections, and the presence of brand‑specific terminology indicates a deliberate attempt to deceive Ledger users. Defenders should add the domain to URL filtering and DNS block lists, monitor for any resurrection attempts, and correlate network traffic against the observed IP address. Continuous ingestion of threat‑intel feeds that reference this domain is recommended to ensure rapid detection should the site become active again.