487432ea[.]bvfhgvuddfh[.]pages[.]dev

Analysis of 487432ea.bvfhgvuddfh.pages.dev indicates a high‑risk brand‑impersonation campaign targeting Ledger users. The site, hosted on Cloudflare’s edge network (AS13335) and resolving to 172.66.47.14, was created on 2 September 2020 and employs HSTS, HTTP/3 and a Google Trust Services / WE1 SSL certificate. HTTP requests return a 403 status, suggesting the content has been removed or restricted; the domain is currently listed as offline by monitoring services. Reputation data shows the domain is flagged by multiple defenses.

Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy has actively blocked it. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. VirusTotal analysis reports that 11 of 93 scanned security vendors identify the domain as malicious, reinforcing the high‑risk assessment. The page title “Ledger Live” and the explicit indication that the site impersonates Ledger confirm a crypto‑scam motive.

No additional page content has been captured, so the exact phishing payload remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host on Cloudflare’s network, and ensure that endpoint protection solutions incorporate the observed vendor detections. Users should be warned that any unsolicited requests claiming to be from Ledger or referencing “Ledger Live” originating from this sub‑domain are fraudulent.