a9342e21[.]memo-ba1[.]pages[.]dev

On July 23, 2026, analysis of the domain a9342e21.memo-ba1.pages.dev identified a high‑risk brand‑impersonation campaign targeting Ledger. The site resolves to IP 172.66.46.227, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration information shows the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are listed as a known Cloudflare service. The web server presents an SSL certificate issued by Google Trust Services under the WE1 label, and the connection enforces HTTP Strict Transport Security and HTTP/3, indicating use of modern Cloudflare infrastructure. The page title returned by the server is “Ledger Live,” matching the advertised brand and confirming the impersonation intent.

The HTTP response code is 403, and the site is currently taken offline. Security scoring systems reflect extreme suspicion: Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing flags the URL for social engineering. VirusTotal reports that 12 of 95 scanned security vendors flagged the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has also listed the domain as blocked. The evidence collectively classifies the site as a crypto‑related scam, consistent with the “Crypto Scam” label in the intelligence.

While the infrastructure details are well documented, the specific payload or credential‑harvesting mechanisms have not been observed, leaving the exact attack vector uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole rules, and monitor for any re‑registration attempts. Incident response teams should treat any traffic to the domain as malicious, and users should be warned against interacting with any Ledger‑related URLs that do not resolve to official Ledger domains. Ongoing surveillance of the associated IP address and Cloudflare account is recommended to detect potential reuse.