ledger-live-ap-p-67c[.]pages[.]dev

On 23 July 2026, the domain ledger-live-ap-p-67c.pages.dev was observed hosting a page whose title references the legitimate Trezor brand. The domain was registered on 21 February 2026 via Cloudflare, Inc., and its authoritative nameservers are lila.ns.cloudflare.com and george.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to the IP address 172.66.46.211, which belongs to AS13335 Cloudflare, Inc., and is geolocated to the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and the HTTP response returned a 403 status code, indicating that the resource is not publicly accessible at the time of analysis. The infrastructure advertises HTTP/3 support and enforces HSTS, consistent with typical Cloudflare front‑end services.

Threat intelligence flags the domain as a wallet/seed phishing campaign. The page title “Trezor.io/Start® - Starting Up Your Device | Trezor®” suggests an attempt to lure users of the Trezor hardware wallet into disclosing seed phrases. The brand target is listed as “across,” indicating a broader impersonation scope. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist. Automated scanning on VirusTotal recorded detections by three of ninety‑three security vendors, reinforcing the malicious classification.

Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme risk. While the HTTP 403 response prevents direct observation of the page content, the combination of a brand‑specific title, low trust score, blocklist presence, and vendor detections provides sufficient evidence to treat the domain as malicious. No additional indicators such as malware hashes, command‑and‑control endpoints, or phishing page screenshots were available at the time of reporting. Defenders should block DNS resolution to ledger‑live‑ap‑p‑67c.pages.dev and any associated IP address 172.66.46.