lve-ledzr[.]pages[.]dev

Analysis of the domain lve-ledzr.pages.dev indicates it was actively impersonating Ledger, a provider of cryptocurrency hardware wallets, with the intent to deceive users into believing they were accessing the legitimate Ledger Live platform. The domain, registered on March 22, 2026, through Cloudflare, Inc., was flagged by 11 of 94 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The page title, 'Ledger Live | Secure Crypto Wallet,' directly mirrors the branding of the authentic Ledger Live service, reinforcing the likelihood of brand impersonation for fraudulent purposes. Infrastructure analysis reveals the domain resolved to the IP address 172.66.44.169, hosted by Cloudflare in Canada, and employed Cloudflare nameservers (crystal.ns.cloudflare.com and norm.ns.cloudflare.com).

The site utilized modern web technologies, including HSTS and HTTP/3, and presented a valid SSL certificate issued by Google Trust Services (WE1). Despite these security features, the domain returned an HTTP 403 status, suggesting access was restricted or the site was taken offline following detection. Gridinsoft assigned a trust score of 0/100, further corroborating its classification as a high-risk domain. The available evidence classifies this as a crypto scam, though the exact mechanics—whether credential harvesting, wallet-draining scripts, or fraudulent transactions—remain unconfirmed due to the site's current offline status.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Security teams are advised to review logs for connections to 172.66.44.169 or the domain itself, particularly from users who may have interacted with it prior to its takedown. Given the use of Cloudflare infrastructure, additional monitoring for similar domains leveraging the same registrar or hosting provider may be warranted to preemptively identify related threats.