ledger-live-app-df[.]pages[.]dev

Analysis of ledger-live-app-df.pages.dev indicates a high‑confidence crypto‑scam infrastructure that impersonates Ledger. The domain was registered on February 21 2026 through Cloudflare, Inc., and uses the authoritative nameservers kyrie.ns.cloudflare.com and nucum.ns.cloudflare.com. DNS resolution points to IP 172.66.44.152, which belongs to AS13335 Cloudflare, Inc. in the United States. The site served an HTTP 403 response with the page title "Suspected phishing site | Cloudflare" and presented a valid SSL certificate issued by Google Trust Services under the WE1 root, confirming proper TLS termination via Cloudflare.

Detected technologies include HTTP/3 and HSTS, confirming modern security headers. Reputation scoring is poor: Scamadviser assigns 41 / 100 while Gridinsoft rates it 0 / 100. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis shows that 2 of 95 antivirus engines flagged the domain, reinforcing malicious intent.

The site is currently offline, suggesting takedown or temporary suspension. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the Cloudflare warning has been captured. Defenders should continue to block the domain at the DNS and firewall layers, monitor the associated IP address for any re‑use, and update endpoint protection signatures to include the observed hash of the SSL certificate and the specific Cloudflare‑issued certificate chain. Organizations that manage Ledger assets should educate users about the impersonation attempt and enforce multi‑factor authentication to mitigate credential compromise.