ladger-liv-wallet-download[.]pages[.]dev

The domain ladger-liv-wallet-download.pages.dev was registered on March 22, 2026 and is presently offline, returning an HTTP 403 status. Analysis indicates that the site was used to impersonate Ledger, as reflected in the page title "Ledger Live — Download Crypto Wallet App | Ledger" and the classification of a crypto‑related scam. The site was hosted behind Cloudflare, Inc., with the IP address 188.114.96.3 located in Canada and served via Cloudflare’s edge network, employing HSTS and HTTP/3. SSL termination was provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate certificate authority but not the legitimacy of the content.

The domain’s nameservers are jamie.ns.cloudflare.com and nitin.ns.cloudflare.com, both owned by Cloudflare. Detection services have flagged the domain: PhishDestroy blocked it, and VirusTotal reported 12 of 94 security vendors marking it as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external blocklist. The registrar listed is Cloudflare, Inc., reinforcing the use of a privacy‑preserving registration service.

While the infrastructure details are concrete, the exact phishing page content and any payloads have not been captured, leaving the specifics of the credential‑harvesting or malware delivery mechanisms uncertain. Defenders should continue to block the domain at perimeter security devices, update URL filtering lists to include the full hostname, and monitor for any resurgence of the same IP or Cloudflare‑associated nameservers. Given the low trust score and multiple vendor detections, the domain should be treated as high‑risk for Ledger‑related credential compromise or crypto‑wallet fraud.