ledger-live-wa-llet-exd[.]pages[.]dev

Analysis of the domain ledger-live-wa-llet-exd.pages.dev shows a confirmed brand‑impersonation infrastructure targeting Ledger users. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge IP 172.66.44.249 located in the United States under ASN 13335. The site served over HTTPS with a Google Trust Services / WE1 certificate and employed HSTS, HTTP/3, and Cloudflare’s caching layer. The HTTP response returned a 403 status code and the page title presented as “Suspected phishing site | Cloudflare”, indicating that the content has been flagged by Cloudflare’s automated protection.

Independent security scoring reflects extreme risk: Gridinsoft assigned a 0 / 100 trust score, Scamadviser a 1 / 100 score, and the domain appears on one known security blocklist. VirusTotal analysis recorded 10 detections out of 93 scanning engines, reinforcing the malicious classification. The site was identified as a crypto‑scam and is listed as impersonating the Ledger brand. Current status shows the domain has been taken offline, and it is blocked by the PhishDestroy feed.

Nameservers jillian.ns.cloudflare.com and ridge.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. While the exact phishing page content has not been captured, the combination of a brand‑specific page title, low trust scores, multiple vendor detections, and the explicit “Impersonates: Ledger” tag provides sufficient evidence to treat the domain as a malicious ledger‑impersonation site. Defenders should add the domain and its resolving IP 172.66.44.249 to blocklists, monitor for re‑registration or similar sub‑domains, and enforce outbound filtering for connections to Cloudflare‑hosted pages that reference Ledger. Ongoing observation of Cloudflare‑issued certificates and any future DNS changes is recommended to detect potential re‑use of the infrastructure.