ledger-live-dbq[.]pages[.]dev

Analysis of ledger-live-dbq.pages.dev indicates a high‑confidence crypto‑focused impersonation of the Ledger brand. The domain was registered on February 21 2026 through Cloudflare, Inc., and is served from the Cloudflare network (AS13335) with the IP address 172.66.44.171 located in the United States. DNS resolution uses the Cloudflare nameservers angela.ns.cloudflare.com and armfazh.ns.cloudflare.com, and the site presented the page title "Suspected phishing site | Cloudflare" before being taken offline. The HTTPS certificate is issued by Google Trust Services under the WE1 identifier, while HTTP responses return a 403 status code, suggesting an intentional block or removal.

Security‑vendor scans on VirusTotal reported 13 detections out of 93 scanners, and the domain appears on a single security blocklist. Independent reputation services assign extremely low scores: Gridinsoft 0 / 100, Scamadviser 1 / 100. The site employed HSTS and HTTP/3, both typical of Cloudflare‑protected services, but no additional infrastructure was observed. The threat is classified as a crypto scam that impersonates Ledger, consistent with the "Impersonates: Ledger" tag.

While the page content has not been captured, the combination of brand targeting, low trust scores, multiple vendor detections, and blocklisting confirms malicious intent. Defenders should update URL filtering rules to block ledger-live-dbq.pages.dev, monitor for similar Cloudflare‑hosted subdomains that reference Ledger, and include the associated IP address 172.66.44.171 in threat‑intel feeds. Continuous re‑scanning is advised in case the domain re‑emerges under a different sub‑path or with altered content.