acess-ledger-x-live[.]pages[.]dev

Analysis indicates that the domain acess-ledger-x-live.pages.dev was registered on 22 March 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.45.40, which is geolocated to Canada. The site serves a page titled “Ledger Crypto Wallet – Security for DeFi”, explicitly targeting the Ledger brand and is classified as a crypto‑scam. HTTP responses are limited to status 403, and the service enforces HSTS and HTTP/3, confirming that the infrastructure is using Cloudflare’s modern edge platform. The TLS certificate is issued by Google Trust Services under the WE1 root, showing a valid HTTPS configuration despite the malicious intent. Threat intelligence sources show that 13 of 94 security vendors on VirusTotal have flagged the domain, and it appears on at least one public blocklist.

PhishDestroy has already taken the site offline, and the current status is reported as offline. The Gridinsoft trust score of 0/100 further reinforces the malicious rating. Nameservers gordon.ns.cloudflare.com and paige.ns.cloudflare.com are consistent with the registrar. Uncertainty remains around the exact content of the page because only the title is available; no additional page elements or payloads have been captured. No evidence of phishing forms, malware delivery, or credential harvesting has been published, limiting the assessment to brand impersonation and potential crypto‑theft.

Defenders should immediately block acess-ledger-x-live.pages.dev at DNS and proxy layers, add the address 172.66.45.40 to network‑level deny lists, and ensure that security appliances reference the blocklist that already contains the domain. Endpoint and email filters should be updated to flag any communications referencing the Ledger brand that originate from this domain or from Cloudflare‑hosted IP ranges newly created after March 2026. Continuous monitoring of newly registered *.pages.