a1ab1bf7[.]source-40r[.]pages[.]dev

Analysis of a1ab1bf7.source-40r.pages.dev shows a high‑risk, brand‑impersonation infrastructure that targets Ledger users. The domain is currently marked offline, but historical data indicates it was actively serving a page titled "Ledger Live" and was classified as a crypto‑scam. Technical tracing reveals the domain resolves to IP 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The site was protected by HSTS, leveraged Cloudflare services, and supported HTTP/3, suggesting a modern delivery stack.

An SSL certificate issued by Google Trust Services (WE1) was in place, yet HTTP requests returned a 403 status, indicating intentional denial of access or removal of content. Security monitoring tools flagged the domain: 14 of 93 VirusTotal vendors reported detections, Google Safe Browsing labeled it as social engineering, and it appears on one external blocklist. The site was also blocked by PhishDestroy, and Gridinsoft assigned a trust score of 0 / 100, reinforcing its malicious reputation. Registration details show the domain was provisioned through Cloudflare, Inc. No additional page content or visual analysis is available.

Defenders should immediately add the domain and its resolving IP to network blocklists and URL filtering policies, especially for users accessing Ledger services. Continuous monitoring of Cloudflare‑hosted subdomains and similar naming patterns is advised, as threat actors often reuse the same infrastructure for new campaigns. User education campaigns should emphasize verification of Ledger URLs and caution against unsolicited prompts that reference "Ledger Live". Given the existing detections and the domain's offline status, remediation efforts should focus on preventing re‑use of the underlying infrastructure and alerting incident response teams to potential resurgence.