7bf8ec90[.]kfhhfdue[.]pages[.]dev

The domain 7bf8ec90.kfhhfdue.pages.dev was observed on July 23, 2026 and is classified as a high‑risk crypto scam targeting the Ledger brand. The site presented the page title "Ledger Live," indicating an attempt to impersonate Ledger's official service. Google Safe Browsing has flagged the domain for social engineering, and the Gridinsoft trust score is 0 out of 100, reflecting a complete lack of credibility. The infrastructure is hosted behind Cloudflare, Inc., with both authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com.

The domain resolves to the IPv6 address 2606:4700:310c::ac42:2f81, which belongs to AS13335, a Cloudflare network located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 designation, and the site enforces HSTS while supporting HTTP/3. An HTTP request returned status code 403, and the domain has since been taken offline. Registration data shows the domain was created on September 02, 2020 and was also registered through Cloudflare, Inc. VirusTotal analysis recorded 12 detections out of 93 security vendors, reinforcing the malicious assessment.

The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. Collectively, the evidence—page title, brand impersonation, safe‑browsing flag, low trust score, vendor detections, and hosting attributes—confirms the domain’s role in a Ledger‑related crypto scam. Defenders should add the domain and its associated IPv6 address to deny‑list policies, monitor for any resurfacing activity, and ensure that endpoint protection solutions reference the observed detection count. Continuous observation of Cloudflare‑hosted assets matching the same registrar and nameserver pattern is advised to pre‑empt future iterations of this campaign.