web-ledgr-liv-nav-logen[.]pages[.]dev

The domain web-ledgr-liv-nav-logen.pages.dev was registered through Cloudflare, Inc. on March 23, 2026 and resolves to the IP address 172.66.45.6, which is owned by Cloudflare and geolocated to Canada. The site currently returns an HTTP 403 status, indicating that the content is inaccessible and the infrastructure is offline as of the report date, July 25, 2026. TLS termination is performed by Cloudflare using an SSL certificate issued by Google Trust Services under the WE1 intermediate, and the server advertises HSTS and HTTP/3, confirming modern security configurations. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal analysis shows three of ninety‑four security vendors flagged the domain, providing additional corroboration of malicious intent. The observed page title, "Ledger Login Portal | Hardware Wallet Access," aligns with the declared brand target Ledger and the identified crypto scam type, indicating a credential‑harvesting operation aimed at hardware‑wallet users. Gridinsoft assigned a trust score of 0/100, reinforcing the suspicion. Nameservers are reza.ns.cloudflare.com and terin.ns.cloudflare.com, both belonging to Cloudflare.

No further hosting, C2 infrastructure, or additional services were identified from the available intelligence. Defenders should add 172.66.45.6 to network blocklists, enforce DNS sinkholing for the domain, and monitor the Cloudflare name‑server records for any changes that could signal re‑use. Continuous observation is advised even while the site remains offline, as re‑activation is common in similar brand‑impersonation campaigns. The evidence collectively points to a Ledger brand impersonation designed to lure victims into submitting wallet credentials, and remediation steps should focus on blocking the IP, domain, and associated DNS entries.