ledger-live-in[.]pages[.]dev

Analysis of ledger-live-in.pages.dev shows a clear indication of brand impersonation targeting Ledger users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers are cullen.ns.cloudflare.com and mina.ns.cloudflare.com, confirming Cloudflare’s hosting. DNS resolution points to IP address 104.21.64.1, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and serves an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS handshake but not legitimacy of the content.

HTTP responses return a 403 status, and the site is protected by HSTS and HTTP/3, typical of modern Cloudflare‑served sites. Security telemetry shows the domain is flagged as a crypto scam, explicitly impersonating the Ledger brand. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. It has been blocked by the PhishDestroy sinkhole and identified by 13 of 93 VirusTotal scanners, reinforcing malicious classification.

While the site is currently offline, the combination of a recent registration date, Cloudflare hosting, low trust score, blocklist presence, and multiple vendor detections warrants a high confidence that the infrastructure was used for fraudulent activity. Defenders should continue to block the domain at network perimeter, monitor for related subdomains or newly registered domains under the same nameservers, and update threat intelligence feeds with the observed indicators. Any inbound traffic to 104.21.64.1 from internal assets should be investigated for potential compromise, and user awareness campaigns should remind Ledger users to verify URLs and avoid unsolicited login requests.