ledger-live-login-cdn-us[.]pages[.]dev

Analysis of ledger-live-login-cdn-us.pages.dev indicates that the domain was registered through Cloudflare, Inc. on March 22, 2026 and resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada. The site served an HTTP 403 response and presents the page title "Ledger Live Login — Secure Access to Your Wallet," directly targeting the Ledger brand. Security telemetry shows the domain appears on a single blocklist, specifically PhishDestroy, and has been flagged by 11 of 94 VirusTotal scanners, confirming partial malicious detection. The hosting environment employs Cloudflare services, including HSTS enforcement and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 root, indicating a legitimate certificate chain despite the malicious intent.

A Gridinsoft trust score of 0 out of 100 was reported, and the nameservers fiona.ns.cloudflare.com and kareem.ns.cloudflare.com are consistent with the registrar. Current operational status is offline, with the domain reported as taken offline. Evidence suggests a brand‑impersonation campaign aimed at credential theft for Ledger users, classified as a crypto‑related scam.

Uncertainty remains around the exact phishing kit or any downstream payload, as no visual or content analysis is available. Defenders should continue to block the domain at perimeter controls, monitor for any re‑hosting attempts, and incorporate the observed indicators—IP address 188.114.96.3, the specific page title, and the PhishDestroy blocklist entry—into threat intelligence feeds. Ongoing observation of Cloudflare‑related abuse patterns is recommended to detect potential re‑use of the infrastructure.