2d0c8d22[.]ledhu98hjgg[.]pages[.]dev

The domain 2d0c8d22.ledhu98hjgg.pages.dev was observed delivering a Ledger brand impersonation campaign and is currently taken offline. Intelligence sources indicate that the site presented a page titled “Ledger Live,” a clear indication of a crypto‑related scam. The infrastructure is hosted behind Cloudflare, Inc., with the DNS resolution pointing to IP address 172.66.45.44, which belongs to AS13335 Cloudflare in the United States. An HTTPS certificate issued by Google Trust Services (WE1) was presented, and the server enforced HSTS while supporting HTTP/3.

HTTP requests to the site returned a 403 status code, suggesting that access was blocked or the content was removed. Security‑vendor scans on VirusTotal reported eight detections out of ninety‑five engines, and the domain appears on a single security blocklist. The Gridinsoft trust score of zero out of one hundred reflects a highly malicious assessment. The site was blocked by the PhishDestroy service, and the overall threat classification is listed as a crypto scam.

Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any re‑registration of the sub‑domain pattern, and enrich endpoint telemetry with the observed IP address and SSL fingerprint. Because the site is offline, active takedown verification is not possible, and further analysis of the underlying content remains limited. Continuous observation of Cloudflare‑hosted subdomains targeting Ledger users is recommended to detect future iterations of this impersonation technique.