get--ledger-livelogin[.]pages[.]dev

The domain get--ledger-livelogin.pages.dev was registered on September 18, 2025 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Ledger Live Login: Secure Access to Your Cryptocurrency Assets" and is classified as a wallet/seed phishing campaign that impersonates the Ledger brand. HTTP requests to the domain returned a 403 status code, and the server advertised HSTS, Cloudflare services, and HTTP/3 support. The SSL certificate observed is identified as "WE1," indicating a valid TLS layer but offering no guarantee of legitimacy.

Reputation checks show the domain appears on a single security blocklist and has been flagged by ten of ninety‑four VirusTotal scanners, reflecting moderate detection across anti‑malware engines. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. Nameservers are gabriella.ns.cloudflare.com and martin.ns.cloudflare.com, both standard Cloudflare resolver entries.

The domain has been taken offline and is currently blocked by the PhishDestroy threat‑intelligence feed. Analysts should continue to monitor the IP address for potential reuse, enforce blocklisting of the domain and its associated IP in perimeter defenses, and educate Ledger users about unsolicited login prompts. Because the site is already offline, immediate remediation focuses on preventing future re‑hosting of the same infrastructure and ensuring that any residual phishing kits are removed from compromised accounts.