ledger-live-login-currency[.]pages[.]dev

The domain ledger-live-login-currency.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is served by Cloudflare’s infrastructure (nameservers jade.ns.cloudflare.com and ganz.ns.cloudflare.com). DNS resolution points to IP address 172.66.46.218, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint despite the malicious intent. An HTTP request returns a 403 status code and the page title is reported as "Suspected phishing site | Cloudflare," confirming that the host is recognized by Cloudflare’s own phishing mitigation system.

The page explicitly impersonates the Ledger brand and is classified as a crypto‑related scam. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, and the domain is listed on at least one external security blocklist. Independent reputation services assign a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 41 / 100, reinforcing the low credibility assessment. Detected technologies include HTTP/3, HSTS, and Cloudflare’s CDN services.

Current operational status is offline, and the domain has been blocked by the PhishDestroy service. Defenders should continue to monitor the domain for any re‑activation attempts, enforce outbound filtering rules that block connections to the resolved IP range, and add the fully qualified domain name to internal blocklists and DNS sinkhole configurations. Because the TLS certificate is legitimate, reliance on certificate validation alone will not prevent exposure; contextual threat intelligence, brand‑specific URL patterns, and the observed reputation scores should be incorporated into security controls. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this domain, and any user reports of Ledger‑related credential requests should be escalated for forensic review.