wallet-en-ledgrlive[.]pages[.]dev

Analysis of wallet-en-ledgrlive.pages.dev shows a newly registered domain (creation date April 30, 2026) that is actively serving content (HTTP 200) and is hosted behind Cloudflare infrastructure (IP 188.114.96.3, CA location). The site presents the page title "Ledger Live Wallet App | Easy Crypto Access®" and is classified as a brand impersonation campaign targeting the Ledger brand. Technical fingerprints include HSTS enforcement, HTTP/3 support, and an SSL certificate issued by Google Trust Services under the WE1 identifier. Nameservers elisa.ns.cloudflare.com and felicity.ns.cloudflare.com confirm registration through Cloudflare, Inc. The domain carries a Gridinsoft trust score of 0/100 and is listed on a single security blocklist. PhishDestroy has already blocked the domain, indicating that defensive teams have observed malicious activity. While VirusTotal scans by 91 vendors have not produced detections, the absence of flags does not constitute safety assurance. Current risk is marked under investigation and the domain remains active. Defenders should add the IP address 188.114.96.3 and the domain name to block lists, monitor DNS queries for similar Cloudflare‑registered names, and enforce strict verification of Ledger‑related communications. Continuous observation is advised to detect any evolution of the campaign or emergence of additional indicators.