ledgerlive-hub-eng[.]pages[.]dev

The domain ledgerlive-hub-eng.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare's network (IP 172.66.47.109, AS13335, United States). The site is served over HTTPS with a Google Trust Services / WE1 certificate and enforces HSTS while supporting HTTP/3. DNS resolution points to the Cloudflare nameservers mustafa.ns.cloudflare.com and kami.ns.cloudflare.com, confirming the use of Cloudflare's edge infrastructure. When accessed, the server returned HTTP 403 and the page title displayed "Suspected phishing site | Cloudflare," indicating that the site has been taken offline by Cloudflare's mitigation mechanisms.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0/100 and Scamadviser 1/100, both reflecting a high likelihood of malicious intent. VirusTotal analysis shows that eight of ninety-three scanning engines flagged the domain, providing additional corroboration of suspicious activity. The intelligence categorizes the operation as a crypto scam that impersonates the Ledger brand, aligning with the "brand impersonation" threat type.

While the page content beyond the title has not been captured, the combination of a brand‑targeted claim, low trust metrics, blocklist presence, and vendor detections constitutes strong evidence of a fraudulent campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or re‑hosting attempts, and advise users to verify Ledger URLs through official channels. Ongoing observation of Cloudflare‑associated IPs and related subdomains is recommended to detect potential pivot activity.