1839236c[.]mfgjgnihfh[.]pages[.]dev

Analysis of 1839236c.mfgjgnihfh.pages.dev indicates that the domain is being used for a Ledger brand impersonation campaign targeting cryptocurrency users. The page title observed is "Ledger Live", which aligns with the legitimate Ledger hardware wallet service, suggesting intentional brand mimicry. The domain was created on 2 September 2020 and is registered through Cloudflare, Inc., with authoritative nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. Infrastructure resolution points to the IP address 188.114.97.3, located in the United States and belonging to AS13335 Cloudflare, Inc. The site employs Cloudflare‑provided security features including HTTP Strict Transport Security (HSTS) and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services under the WE1 authority.

Multiple defensive feeds have flagged the domain. Google Safe Browsing categorises it as social engineering, and PhishDestroy has actively blocked it. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal analysis shows that 12 of 93 scanning engines flagged the site, reinforcing the malicious assessment.

The current HTTP response is 403, and the domain has been taken offline at the time of reporting. While the exact content of the landing page has not been captured, the combination of brand‑specific page title, crypto‑related scam type, and the defensive indicators strongly suggests a credential‑harvesting or crypto‑drain operation aimed at Ledger users. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the domain and its associated Cloudflare nameservers, and update detection signatures to include the observed SSL issuer and page title. Ongoing observation of any re‑registration attempts or new sub‑domains is advised, as the infrastructure could be reused in future impersonation campaigns.