ledger-live-wallet-mg-us[.]pages[.]dev

Analysis of ledger-live-wallet-mg-us.pages.dev shows a recent infrastructure set up to impersonate Ledger, a well‑known hardware‑wallet brand. The domain was registered on February 21 2026 and resolves to the Cloudflare address 172.66.44.90, associated with AS13335 (Cloudflare, Inc.) in the United States. The site presented a Cloudflare‑issued SSL certificate issued by Google Trust Services under the WE1 label, and the HTTP response returned a 403 status code, indicating that access was denied, likely as a result of an automated takedown. Technical fingerprints include HTTP/3 support, enforced HSTS, and the use of Cloudflare’s edge services, consistent with the listed nameservers greg.ns.cloudflare.com and shaz.ns.cloudflare.com.

The page title returned by the server is "Suspected phishing site | Cloudflare," reinforcing the classification as a brand‑impersonation vector. Trust metrics are uniformly low: Gridinsoft assigns a score of 0 / 100, Scamadviser a score of 1 / 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, further confirming malicious intent.

The site was identified as a crypto‑related scam, targeting users of Ledger wallets. Defensive recommendations include adding the domain and its IP address to local deny lists, monitoring Cloudflare‑issued certificates for similar naming patterns, and ensuring that endpoint protection solutions reference the current blocklist entries. Because the domain is currently offline and has been taken down by PhishDestroy, ongoing surveillance should focus on any re‑registration attempts or related sub‑domains that reuse the same infrastructure or certificate profile.