ledger-liv-e-3vq[.]pages[.]dev

The domain ledger-liv-e-3vq.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. A TLS certificate issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain secures the host, and the site presents a HTTP 403 response with a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare”. The infrastructure employs HSTS, Cloudflare services, and HTTP/3, indicating a modern delivery stack. Reputation signals are extremely poor: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and the domain appears on a single security blocklist.

VirusTotal analysis shows that 14 out of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. The site is classified as a “Crypto Scam” and explicitly impersonates the Ledger brand, which is corroborated by the “Impersonates: Ledger” indicator. Defensive actions taken by the community include a block by PhishDestroy and the current offline status, as reflected by the HTTP 403 page.

Defenders should continue to deny traffic to the IP 188.114.97.3, add the fully‑qualified domain name to URL filtering and DNS blocklists, and monitor for any rapid re‑registration attempts that might reuse the same naming pattern. Analysts should also watch for related domains using the same Cloudflare nameservers (meg.ns.cloudflare.com, zahir.ns.cloudflare.com) or similar certificate issuers, as these may indicate a shared campaign infrastructure. Because the domain is already taken offline, immediate incident response focus should shift to detecting any credential harvesting attempts that may have originated while the site was active, and to informing Ledger users of the impersonation attempt through trusted communication channels.