us-ledger-lives[.]pages[.]dev

Analysis indicates that the domain us-ledger-lives.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is served from the IPv6 address 2a06:98c1:3121::3, which belongs to AS13335 Cloudflare in the United States. The site presents the page title “Ledger Live Wallet – Secure Crypto & NFT Management” and is classified as a wallet/seed phishing campaign that impersonates the Ethereum ecosystem. Technical fingerprints show that the host enforces HTTP Strict Transport Security, uses Cloudflare’s edge services and HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 label. HTTP requests return a 403 status code, and the domain currently appears offline.

Reputation data reveal that the domain is listed on one security blocklist and has been flagged by 12 of 93 security vendors on VirusTotal. The site is also blocked by PhishDestroy and receives a Gridinsoft trust score of 0 / 100, indicating extreme malicious confidence. Nameservers evelyn.ns.cloudflare.com and burt.ns.cloudflare.com confirm the Cloudflare registration. The available evidence confirms a deliberate attempt to lure victims into entering Ledger Live credentials or seed phrases, leveraging the legitimate‑sounding page title to increase credibility.

However, the offline status limits immediate observation of the landing page content, and no additional indicators such as malicious payload hashes or command‑and‑control endpoints have been disclosed. Defenders should add the domain and its associated IPv6 address to internal blocklists, monitor DNS queries for the Cloudflare nameservers, and enforce strict outbound filtering for any traffic attempting to resolve or contact this host. Because the certificate is issued by a trusted CA, reliance on certificate validation alone is insufficient; organizations should also employ URL filtering, reputation services, and endpoint detection that can flag the known vendor detections.