ledger-live-login-hub[.]pages[.]dev

Analysis of ledger-live-login-hub.pages.dev indicates a confirmed brand‑impersonation campaign targeting Ledger users. The site presented the page title “Ledger Live Login – Secure Access to Your Crypto Wallet”, directly referencing Ledger’s official service. Registration data shows the domain was created on 22 March 2026 and is hosted through Cloudflare, Inc., as reflected by both the registrar entry and the authoritative nameservers lee.ns.cloudflare.com and marge.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, an address owned by Cloudflare and located in Canada, consistent with the reported IP location. The TLS certificate was issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the malicious intent.

HTTP requests return status code 403, suggesting the content is no longer publicly accessible; the domain is currently listed as offline. Infrastructure analysis reveals the presence of modern web technologies including HSTS, Google Analytics, Cloudflare services, and HTTP/3, which are typical of legitimate sites and may be used to increase credibility. The domain appears on a single security blocklist, identified by PhishDestroy, and has been flagged by 16 of 94 security vendors on VirusTotal, indicating moderate detection across the threat‑intelligence ecosystem. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

The scam type is recorded as a crypto scam, aligning with the Ledger brand impersonation. While the site is presently inaccessible, the combination of brand‑specific page title, recent registration, Cloudflare hosting, valid TLS, and multiple vendor detections provides sufficient evidence for defensive operators to block the domain at network perimeters and update URL filtering rules. Continuous monitoring of the associated IP range and related Cloudflare‑hosted domains is recommended, as adversaries frequently recycle infrastructure.