ledgglivewalk[.]pages[.]dev

Analysis indicates that the domain ledgglivewalk.pages.dev is actively hosting a brand‑impersonation page targeting Ledger. The site was registered on April 01 2026 through Cloudflare, Inc., and resolves to the Cloudflare IP address 188.114.96.3 located in Canada. DNS resolution uses the Cloudflare nameservers damiete.ns.cloudflare.com and eva.ns.cloudflare.com. The HTTPS service is provided by Google Trust Services under the WE1 certificate, and the server presents HSTS, HTTP/3, and Cloudflare protection. A page title of "Ledger Live Wallet – Secure" is observed, matching the declared brand target. VirusTotal reports four of ninety‑four security vendors flag the domain, and the domain appears on a single blocklist, currently blocked by PhishDestroy. The Gridinsoft trust score is 0/100, indicating a high likelihood of malicious intent. The recent creation date suggests the campaign may be newly deployed. No additional technical artifacts such as malware payloads or credential‑stealing scripts have been disclosed. Defenders should block the domain at the network perimeter, monitor DNS queries for the domain and its associated IP, and ensure that any credential‑entry points for Ledger services are protected with multi‑factor authentication. Ongoing intelligence collection is recommended to detect possible campaign evolution.