ledgerlivewallet-aeu[.]pages[.]dev

Analysis on July 24, 2026 flags ledgerlivewallet-aeu.pages.dev as an elevated‑risk brand‑impersonation site targeting Ledger users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.119 located in the United States under ASN 13335. TLS termination uses a Google Trust Services / WE1 certificate, and the site advertised HSTS and HTTP/3 support. An HTTP request returned a 403 status code and the page title reported “Suspected phishing site | Cloudflare”, indicating that the host had already been flagged by Cloudflare’s protective services.

VirusTotal recorded a single positive detection out of 93 scanning engines, and the domain appears on one external blocklist and has been actively blocked by PhishDestroy. Reputation metrics are poor, with Gridinsoft assigning a 0 / 100 score and Scamadviser reporting 36 / 100. The listed scam type is “Crypto Scam”, and the site is cataloged as impersonating the Ledger brand.

Current infrastructure status is offline, preventing live content inspection; the only concrete evidence derives from registry data, DNS configuration, SSL metadata, HTTP response, and third‑party security scans. Defenders should continue to deny any network traffic to the domain, add the address and its associated IP range to local blocklists, and monitor for similar sub‑domains that use the “pages.dev” suffix with Cloudflare nameservers. Ongoing vigilance is recommended because the underlying Cloudflare infrastructure could be reused for future impersonation campaigns targeting cryptocurrency users.