guide-live-ledgr-eng-ami[.]pages[.]dev

Analysis of the domain guide-live-ledgr-eng-ami.pages.dev indicates it was actively involved in a crypto scam impersonating Ledger, a cryptocurrency hardware wallet provider. The domain, registered on March 23, 2026, through Cloudflare, Inc., resolved to the IP address 172.66.47.65, located in Canada under Cloudflare's infrastructure. The page title, 'Ledger® Live — Getting started with Ledger™ (1500-word guide),' explicitly suggests an attempt to mimic Ledger’s official documentation or onboarding materials, aligning with the identified scam type of crypto fraud. Infrastructure analysis reveals the use of Cloudflare technologies, including HSTS and HTTP/3, alongside nameservers jakub.ns.cloudflare.com and natasha.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare’s services.

As of July 23, 2026, the domain has been taken offline, returning an HTTP 403 status, which may indicate remediation efforts or voluntary takedown. Detection data from security vendors provides further evidence of malicious intent. Twelve of 94 vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing the domain’s classification as high-risk. While no additional details about the phishing kit or specific attack vectors are available, the combination of brand impersonation, crypto scam classification, and detection by multiple security vendors confirms its role in fraudulent activity.

Defenders are advised to treat this domain as confirmed malicious and update blocklists accordingly. Given its offline status, monitoring for re-registration or similar domains using Cloudflare’s infrastructure is recommended.