ledgerlivelogin-com[.]pages[.]dev

Analysis of the domain ledgerlivelogin-com.pages.dev indicates a confirmed phishing operation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.44.183, hosted on Cloudflare's network (AS13335). The page title, 'Suspected phishing site | Cloudflare,' aligns with Cloudflare's automated warning system for flagged content, though no additional details about the page's exact content or functionality are available at this time. Infrastructure analysis reveals the use of Cloudflare nameservers (nolan.ns.cloudflare.com and kristina.ns.cloudflare.com) and technologies including HSTS and HTTP/3, which are consistent with modern web hosting but do not inherently indicate malicious intent. The domain's SSL certificate is issued by Google Trust Services (WE1), a legitimate certificate authority, which does not preclude its use in phishing campaigns.

As of July 24, 2026, the domain returns an HTTP 403 status, suggesting it has been taken offline or restricted, though the exact cause—whether due to enforcement action or voluntary takedown—remains unclear. Detection data from security vendors shows mixed but concerning results: 9 out of 95 vendors on VirusTotal flagged the domain as malicious, a ratio that, while not definitive, supports the classification of elevated risk. The domain appears on at least one security blocklist, and Gridinsoft assigned it a trust score of 0/100, further corroborating its malicious classification. The scam type is explicitly labeled as a 'Crypto Scam,' which aligns with the targeting of Ledger users, though specific tactics (e.g., credential harvesting, wallet drainers, or fake giveaways) cannot be confirmed without further analysis of the page content.

Defenders should treat this domain as a confirmed phishing threat targeting Ledger's user base. Recommended actions include blocking the domain and its resolving IP (172.66.44.