best-ledger-live-io[.]pages[.]dev

Analysis of best-ledger-live-io.pages.dev indicates a brand impersonation phishing domain targeting users of the Ledger Live cryptocurrency wallet application. The domain, registered on February 21, 2026, through Cloudflare, Inc., presents a page title explicitly claiming to be the 'Official App for Secure Crypto Management,' a direct mimicry of Ledger Live's branding. Infrastructure analysis reveals the domain resolves to 172.66.45.10, hosted on Cloudflare's network (AS13335) in the US, with nameservers thomas.ns.cloudflare.com and colette.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted domains.

Detection data shows the domain has been flagged by at least one security vendor, with PhishDestroy listing it as blocked. Trust scores from Scamadviser (41/100) and Gridinsoft (0/100) further indicate elevated risk, though these metrics alone are not conclusive. The domain appears on one security blocklist, and as of July 24, 2026, it returns an HTTP 403 status, suggesting it has been taken offline or restricted. The scam type is classified as wallet/seed phishing, a method commonly used to harvest cryptocurrency wallet credentials or recovery phrases.

No evidence of widespread detection on platforms like VirusTotal is present in the available data, and the exact content of the phishing page remains unanalyzed. Defenders should treat this domain as a confirmed phishing threat, particularly for users of Ledger Live or similar cryptocurrency management tools. Recommended actions include blocking the domain and IP at the network level, monitoring for related infrastructure (e.g., Cloudflare-hosted subdomains), and alerting users to the risk of wallet credential theft. Further investigation into associated email addresses, registration details, or linked campaigns may uncover additional threat vectors.