ledger-live-fox[.]pages[.]dev

Analysis of ledger-live-fox.pages.dev indicates that the domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.47.156, which belongs to AS13335 Cloudflare, Inc. in the United States. The site serves a Cloudflare-provided page titled "Suspected phishing site | Cloudflare" and returns HTTP status code 403, suggesting that access is intentionally blocked. The TLS certificate is issued by Google Trust Services under the WE1 identifier, and the connection enforces HSTS while supporting HTTP/3, confirming the use of modern Cloudflare infrastructure.

Security telemetry shows that ten of ninety-three VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. Reputation services assign extremely low scores: Gridinsoft rates the domain at 0 out of 100 and Scamadviser at 1 out of 100, reinforcing the perception of malicious intent.

The domain is identified as a brand impersonation targeting Ledger and is categorized as a crypto scam, though the exact payload or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers (cecelia.ns.cloudflare.com, dean.ns.cloudflare.com), and consider adding the domain to internal blocklists. Since the site is currently offline, any active investigations should focus on historical request logs and potential victim outreach, while remaining vigilant for re‑hosting attempts under similar subdomains.