ledger-live-downlloadd[.]pages[.]dev

Analysis of ledger-live-downlloadd.pages.dev shows that the domain was registered on February 21, 2026 and is currently taken offline, returning HTTP 403. The site presents the generic Cloudflare page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare has flagged the content. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. SSL/TLS is provided by Google Trust Services under the WE1 certificate, a standard certificate issued for Cloudflare‑protected sites.

Technical fingerprints include HSTS, HTTP/3 and the default Cloudflare nameservers justin.ns.cloudflare.com and raina.ns.cloudflare.com. Reputation services uniformly score the domain poorly: Scamadviser assigns a trust score of 1/100, Gridinsoft reports 0/100, and the domain appears on a single public blocklist. VirusTotal records 14 detections out of 95 scanned engines, and the site is listed as blocked by the PhishDestroy feed. The threat profile identifies the site as a “Crypto Scam” that impersonates the Ledger brand, a well‑known hardware wallet provider.

No additional intelligence such as Safe Browsing, OTX, or sandbox analysis is available in the current dataset. Given the observable indicators – low trust scores, multiple vendor detections, Cloudflare‑issued warning page, and the explicit brand impersonation – defenders should treat the domain as malicious. Recommendations include adding the domain and its IP address to local deny lists, monitoring for any future re‑registration or DNS changes, and ensuring that endpoint protection solutions are updated to flag the associated threat signatures. Because the domain is already offline, active takedown is not required, but continued observation of the hosting infrastructure is advisable in case the actor migrates to a new domain or leverages the same Cloudflare account for further campaigns.