e9a5900d[.]bfhjbfhjfh[.]pages[.]dev

This domain, e9a5900d.bfhjbfhjfh.pages.dev, was observed hosting a page whose title reads “Ledger Live”, indicating an attempt to impersonate the Ledger brand. The site resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. The domain was registered on September 2 2020 through Cloudflare, and its authoritative name servers are adi.ns.cloudflare.com and karl.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming the use of a valid HTTPS certificate. HTTP responses return a 403 status code, and the site employs HSTS and HTTP/3, both typical of Cloudflare‑protected services.

Security tooling flags the domain as high‑risk. The Gridinsoft trust score is 0 / 100, and VirusTotal reports 13 detections out of 93 scanned vendors. The domain appears on a single blocklist, specifically PhishDestroy, which has already taken the site offline. The overall scam classification is a crypto‑related scam, consistent with the Ledger impersonation vector. Defenders should immediately block the domain and the associated IP address at perimeter filters.

Because the domain is hosted on Cloudflare’s shared infrastructure, additional monitoring of other subdomains that resolve to the same IP is advisable. Threat‑intel feeds should be updated to include the domain, its nameservers, and the 188.114.97.3 address. Continuous re‑query of VirusTotal and similar multi‑engine scanners is recommended, as the detection count may evolve. Finally, organizations that use Ledger services should remind users to verify URLs and to avoid entering credentials on any site that does not resolve to official Ledger domains.