e6b8c581[.]solvee[.]pages[.]dev

Analysis of the domain e6b8c581.solvee.pages.dev indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The site is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 172.66.44.76, which is located in the United States. DNS resolution is provided by adi.ns.cloudflare.com and karl.ns.cloudflare.com, both Cloudflare name servers, and the domain was registered through Cloudflare, Inc. on September 2 2020. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, confirming that HTTPS is correctly terminated but offering no indication of malicious content. The HTTP response code returned by the server is 403, suggesting that the page is currently inaccessible; the status field also records that the domain has been taken offline.

Despite the offline state, the infrastructure remains noteworthy. The site advertises the page title “Ledger Live,” directly mimicking the official Ledger application, and is classified as a “Crypto Scam” in the supplied intelligence. Google Safe Browsing flags the domain for social engineering, and it appears on a single security blocklist. VirusTotal analysis shows that ten of ninety‑three scanning engines have raised detections, reinforcing the suspicion of malicious intent. Additional reputation data includes a Gridinsoft trust score of 0 / 100, indicating an extremely low confidence rating.

Detected technologies include HTTP/3, HSTS, and Cloudflare’s edge services, all of which are typical for legitimate sites but also provide the attacker with fast, encrypted delivery. The combination of brand impersonation, a page title that references Ledger Live, and the presence of multiple security vendor detections points to a coordinated attempt to lure cryptocurrency users into disclosing credentials or installing malicious software.