lderglive-support[.]pages[.]dev

Analysis of lderglive-support.pages.dev indicates that the domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare edge address 188.114.96.3 associated with ASN 13335 in the United States. The site presents a page title of “Suspected phishing site | Cloudflare” and returns HTTP 403, suggesting that the content is being blocked or taken offline. The TLS certificate is issued by Google Trust Services under the WE1 CA, confirming the use of a valid certificate but offering no assurance of legitimacy. Security telemetry shows the domain appears on a single blocklist, PhishDestroy, and 15 of 95 VirusTotal scanners have flagged it as malicious, reflecting moderate detection consensus.

Trust scoring services assign very low reputation values: Gridinsoft scores the domain 0 out of 100 and Scamadviser rates it 1 out of 100, both indicating extreme distrust. The identified scam type is brand impersonation targeting Ledger, and the page title explicitly references a suspected phishing site, confirming the intent. Infrastructure fingerprints reveal the presence of HSTS, Cloudflare CDN, and HTTP/3, which are common to many legitimate services but also frequently leveraged by malicious actors to hide behind reputable hosting. Nameservers henrik.ns.cloudflare.com and dayana.ns.cloudflare.com are standard Cloudflare delegations.

Current status is offline, limiting immediate victim exposure, yet the underlying IP and hosting configuration remain active and may be reused. Defenders should block the domain and its resolving IP, add the domain to internal blocklists, monitor for re‑registration or similar sub‑domains, and continue to reference the observed detection counts and trust scores when evaluating related traffic. Ongoing vigilance is advised given the low trust scores and the presence on at least one dedicated phishing blocklist.