ledger-livee-download[.]pages[.]dev

Analysis of the domain ledger-livee-download.pages.dev indicates a targeted crypto phishing operation impersonating Ledger, a hardware wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP address 172.66.46.242, hosted on Cloudflare's network (AS13335) in the United States. At the time of assessment, the domain is offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting detection by Cloudflare's security mechanisms. Infrastructure analysis reveals the use of Cloudflare nameservers (nero.ns.cloudflare.com, elaine.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1).

Technologies detected include HSTS and HTTP/3, which are consistent with modern web hosting but do not mitigate the domain's malicious intent. The domain appears on one security blocklist and is flagged by 15 of 93 security vendors on VirusTotal, supporting its classification as a phishing threat. Trust scores from Gridinsoft and Scamadviser are both 0/100 and 1/100, respectively, further indicating high-risk activity. The domain's scam type is explicitly classified as a crypto scam, and the brand target is confirmed as Ledger.

No evidence of a specific phishing kit or additional malicious payloads is present in the available data. Defenders should treat this domain as a confirmed phishing resource and ensure it is blocked at the DNS and network levels. Given its association with Cloudflare Pages and the use of legitimate hosting infrastructure, monitoring for reactivation or similar domains under the same registrar is recommended. The domain's current offline status does not eliminate the risk of future misuse, and historical logs should be reviewed for prior interactions.