en-live-ledgr--us[.]pages[.]dev

The domain en-live-ledgr--us.pages.dev was observed hosting a web page whose title reads “Ledger Live | Secure Crypto Wallet”. The page title, combined with the declared brand target “Ledger”, indicates a clear attempt to masquerade as an official Ledger service. The domain was registered on March 22 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.47.102 located in Canada. Both authoritative nameservers, ines.ns.cloudflare.com and plato.ns.cloudflare.com, resolve to the same provider, confirming that the infrastructure is fully hosted on Cloudflare’s network.

HTTP requests to the site return a 403 status code, and the site is currently taken offline, yet its presence on at least one security blocklist and its classification by PhishDestroy as a “Crypto Scam” demonstrate that it was actively used for malicious purposes before removal. Passive analysis shows the site employed HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services under the “WE1” name, which is typical for Cloudflare‑proxied sites but does not mitigate the malicious impersonation. VirusTotal scanned the domain and recorded detections by ten of ninety‑four antivirus or URL‑reputation engines, reinforcing the malicious assessment. Additionally, Gridinsoft assigned a trust score of zero out of one hundred, indicating a complete lack of trustworthiness.

The elevated risk rating aligns with the observed evidence. While the domain is no longer reachable, its registration timestamp and the rapid takedown suggest a short‑lived campaign targeting Ledger users. Defenders should continue to block the domain and the associated IP 172.66.47.102 at the network perimeter, update URL filtering lists, and advise users to verify Ledger URLs against official sources. Ongoing monitoring of Cloudflare‑hosted IP ranges for similar brand‑impersonation patterns is recommended, as the underlying hosting provider can be reused for future campaigns.