le-welcomee-ledger-live[.]pages[.]dev

This domain, le-welcomee-ledger-live.pages.dev, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as indicated by its page title 'Ledger® Live: | Getting started - Ledger®' and confirmed brand target. Registered on September 15, 2025, through Cloudflare, the domain resolves to 188.114.97.3 (Cloudflare, Inc., CA) and uses Cloudflare nameservers (brady.ns.cloudflare.com, erin.ns.cloudflare.com). The site employs HSTS and HTTP/3, with a valid SSL certificate issued by Google Trust Services (WE1), returning an HTTP 200 status. Analysis indicates it is classified as a crypto scam, with 15 of 91 security vendors flagging it on VirusTotal. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100. While the exact content and functionality of the site remain unanalyzed, the infrastructure and naming strongly suggest an attempt to deceive users into disclosing cryptocurrency wallet credentials or installing malicious software. Defenders should treat this domain as high-risk, prioritize blocking at DNS and network levels, and monitor for related infrastructure or phishing campaigns targeting Ledger users. No additional threat actor attribution or campaign linkage is available at this time.