ledger-live-wallet-us[.]pages[.]dev

The domain ledger-live-wallet-us.pages.dev was created on February 21, 2026 and is currently taken offline. Technical inspection shows it resolves to IP address 172.66.44.125, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are lila.ns.cloudflare.com and jakub.ns.cloudflare.com, confirming registration through Cloudflare, Inc. The site served over HTTPS using a Google Trust Services / WE1 certificate and advertised HSTS and HTTP/3 support. An HTTP request returned status code 403, and the page title reported by the server is "Suspected phishing site | Cloudflare".

Reputation scoring is poor: Gridinsoft assigns a trust score of 0 / 100, Scamadviser rates the domain 41 / 100, and the domain appears on a single security blocklist. It has been blocked by PhishDestroy and was flagged by three of ninety‑three VirusTotal scanners. The listed scam type is "Crypto Scam" and the brand target is Ledger, indicating a brand‑impersonation attempt aimed at cryptocurrency users.

While the site is offline, the combination of a recent registration date, low trust scores, blocklist presence, and vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter, add the IP 172.66.44.125 to deny lists, monitor for any re‑activation, and correlate any Ledger‑related credential or transaction anomalies with this indicator. Ongoing threat‑intel feeds should be consulted for potential reuse of the same infrastructure in other campaigns.