ledgerlivewallettt[.]pages[.]dev

The domain ledgerlivewallettt.pages.dev was registered on February 21, 2026 and is hosted on Cloudflare's network (AS13335) with the IP address 104.21.96.1 located in the United States. The site presents a Cloudflare‑issued SSL certificate from Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3, indicating a modern web stack. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting access is currently denied. Intelligence indicates the domain is explicitly impersonating the Ledger brand and is classified as a crypto‑related scam.

Reputation metrics are extremely low, with a Scamadviser trust score of 1 out of 100, a Gridinsoft score of 0 out of 100, and detection by at least one security blocklist. VirusTotal analysis shows 15 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion. The domain is also listed as blocked by PhishDestroy.

Nameserver records point to maya.ns.cloudflare.com and terry.ns.cloudflare.com, both owned by Cloudflare, confirming the registrar as Cloudflare, Inc. Current operational status is offline, but the combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist presence provides strong evidence that the domain was used for a Ledger‑targeted crypto scam. Defenders should add the domain to deny‑list rules, monitor the associated IP range for re‑use, and ensure endpoint protection solutions are updated to reflect the 15 vendor detections. Continuous observation of Cloudflare‑hosted domains targeting Ledger is recommended, as the infrastructure could be repurposed for future impersonation campaigns.