ledger-live-wa-llet[.]pages[.]dev

Analysis of the domain ledger-live-wa-llet.pages.dev confirms its classification as a phishing site targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered through Cloudflare, Inc. on February 21, 2026, and hosted on Cloudflare's infrastructure (AS13335) with the IP address 172.66.46.211, located in the United States. Nameservers earl.ns.cloudflare.com and tricia.ns.cloudflare.com further link the domain to Cloudflare's network. At the time of assessment (July 23, 2026), the domain appears on one security blocklist and is flagged by 13 of 93 security vendors on VirusTotal, indicating broad detection as malicious.

The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, offering no definitive signal of trustworthiness. The HTTP status returned is 403 (Forbidden), and the page title displayed is 'Suspected phishing site | Cloudflare,' which aligns with its current offline status and prior classification. Infrastructure analysis reveals the use of Cloudflare's hosting and security features, including HSTS and HTTP/3, which are frequently employed to obscure malicious activity behind legitimate CDN services. The domain's Gridinsoft trust score of 0/100 further corroborates its malicious classification.

While the exact content of the site remains unanalyzed, the available evidence—including the domain name, brand impersonation of Ledger, and detection by security vendors—confirms its role in a crypto-focused phishing campaign. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the network and endpoint levels. Given its association with Cloudflare Pages, monitoring for newly created subdomains under *.pages.dev with similar naming patterns (e.g., brand impersonation) may aid in early detection of related threats.