user-ledger-safe-wallet-liv[.]pages[.]dev

The domain user-ledger-safe-wallet-liv.pages.dev was observed serving a page whose title is "Suspected phishing site | Cloudflare" and returning HTTP 403. The site was provisioned on 21 February 2026 and is hosted behind Cloudflare’s edge network (ASN 13335) with the IP address 172.66.44.92 located in the United States. Cloudflare‑provided DNS resolvers (uma.ns.cloudflare.com and dante.ns.cloudflare.com) are listed as the authoritative nameservers, and the TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS configuration with HSTS and HTTP/3 support. The page is classified as a crypto‑related scam and explicitly impersonates the Ledger brand, matching the supplied brand target. Independent analysis on VirusTotal shows that 13 of 93 scanning engines flagged the domain, and the site appears on at least one public security blocklist.

Reputation services assign extremely low scores: Gridinsoft reports 0 / 100 and Scamadviser 1 / 100. The registrar listed is Cloudflare, Inc., and the domain has already been taken offline, with PhishDestroy confirming its removal from active service. Analysis indicates that the infrastructure leverages Cloudflare’s CDN to obscure the true origin of the content while still exposing the edge IP address, a common tactic for credential‑stealing or cryptocurrency‑draining campaigns. The combination of a brand‑specific impersonation, a low reputation rating, and multiple vendor detections suggests a deliberate attempt to lure Ledger users into disclosing wallet credentials or private keys. However, because the site returned a 403 response and is currently offline, the exact content and any payloads delivered cannot be verified at this time.

Defenders should continue to block the domain and the associated IP address at perimeter filters, add the nameservers and IP to threat‑intel feeds, and monitor for any re‑registration attempts or similar sub‑domains that target the Ledger brand.