ledger-live-app--web[.]pages[.]dev

The domain ledger-live-app--web.pages.dev was created on March 24, 2026 and is presently listed as taken offline. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc. with authoritative nameservers josh.ns.cloudflare.com and penny.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.138, which is registered to Cloudflare in Canada. The HTTPS service is delivered by a Google Trust Services certificate issued to the WE1 organization, and the server advertises HSTS and HTTP/3, confirming the use of modern security protocols.

An HTTP request to the host returns a 403 status code, indicating that direct content access is denied at the time of testing. The page title retrieved from the site reads "Ledger Live Crypto Wallet App | Ledger," directly matching the targeted brand Ledger and confirming the claim of brand impersonation. VirusTotal analysis records six detections out of ninety‑four scanning engines, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already flagged the site as malicious. Additional reputation data includes a Gridinsoft trust score of zero out of one hundred, reinforcing the low credibility of the host.

The combination of a brand‑specific page title, a recent registration date, Cloudflare‑based hosting, a low trust score, multiple vendor detections, and an existing blocklist entry provides concrete evidence that the domain was employed for Ledger brand impersonation. What remains uncertain is the exact content served when the 403 response is bypassed, as no visual or functional analysis is available. defenders should continue to block the domain at perimeter defenses, add the associated IP address to threat‑intel feeds, and monitor for newly registered domains that use similar naming patterns or Cloudflare hosting.