learn-ledger-live-strt-us[.]pages[.]dev

On July 24, 2026 the domain learn-ledger-live-strt-us.pages.dev was observed to be hosted behind Cloudflare (Inc.) and resolved to IP 188.114.97.3, which is geolocated to Canada. The site returned HTTP 403, advertised the page title “Ledger Live Crypto Wallet | Ledger2000”, and claims to be associated with Ledger. VirusTotal scanned the host and 9 of 94 AV engines flagged it as malicious. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy.

Technical fingerprinting shows the site forces HSTS, uses Cloudflare’s edge network and HTTP/3, and presents an SSL certificate issued by Google Trust Services (WE1). The registrar is Cloudflare, Inc., and the authoritative nameservers are diva.ns.cloudflare.com and justin.ns.cloudflare.com. Gridinsoft assigned a trust score of 0 / 100, and the intelligence categorises the activity as a “Crypto Scam” aimed at Ledger users. The domain was created on 22 March 2026, indicating a short‑lived infrastructure typical of opportunistic brand‑impersonation campaigns.

No additional page content, login forms, or malware payloads have been disclosed, so the exact method of credential or asset theft remains uncertain. Defensive recommendations include adding the domain to network and web‑filter block lists, monitoring DNS queries for the associated IP address and nameservers, and configuring TLS inspection to detect the Google‑issued certificate. Organizations should alert end‑users about the fraudulent Ledger Live branding and instruct them to verify URLs against official Ledger domains. Continuous threat‑intel monitoring is advised to capture any re‑hosting attempts that may emerge under new subdomains or alternate Cloudflare‑proxied addresses.