ledge-live-login-connect[.]pages[.]dev

On July 24, 2026, the domain ledge-live-login-connect.pages.dev was observed hosting a credential-collection page that claims to be the “Ledger® Live Login”. The page title returned by the web server is “Ledger® Live Login | Encrypted”, confirming the impersonation of the Ledger brand. The site was created on 22 March 2026 and is currently marked offline with an HTTP 403 response, indicating that the content is no longer publicly reachable. Infrastructure analysis shows the domain resolves to the Cloudflare IP address 188.114.96.3, located in Canada and served through Cloudflare’s edge network. The domain is registered through Cloudflare, Inc., and the authoritative nameservers are georgia.ns.cloudflare.com and rustam.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate issued to the WE1 entity, and the server advertises HSTS and HTTP/3 support, consistent with typical Cloudflare configurations.

Reputation signals are strongly negative. The domain appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal reports that 12 of 94 scanned security vendors flagged the host, reinforcing the malicious classification. A Gridinsoft trust score of 0 out of 100 further indicates a lack of legitimacy. The observed scam type is a crypto-related scam, targeting users of Ledger’s hardware wallet ecosystem.

Although the site is presently inaccessible, the infrastructure—particularly the use of Cloudflare’s free hosting and a legitimate SSL certificate—demonstrates a common tactic of leveraging reputable services to lend credibility to fraudulent pages. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re-registration attempts, and add the associated IP address 188.114.96.3 to threat-intel feeds.