ledger-live-des-ktop-92f[.]pages[.]dev

The domain ledger-live-des-ktop-92f.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently hosted on Cloudflare’s network (AS13335) with the resolved address 172.66.47.179 located in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and is classified as a crypto‑related scam that impersonates the Ledger brand. HTTP responses return a 403 status code, and the server advertises HSTS, Cloudflare protection, and HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid TLS layer despite the malicious intent.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, and Scamadviser rates the domain at 1 / 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 11 of 93 scanned security vendors flag the domain, reinforcing the malicious assessment.

No visual content or page payload has been captured, so the precise phishing content cannot be described beyond the title and branding claim. Defenders should immediately block the domain at perimeter and DNS filtering layers, add the IP address 172.66.47.179 to threat‑intel feeds, and monitor for newly observed subdomains using the same Cloudflare name‑servers (janet.ns.cloudflare.com, neil.ns.cloudflare.com). Ongoing surveillance of Cloudflare‑hosted assets targeting Ledger users is advised, as the rapid creation date and low trust scores suggest a purposeful brand‑impersonation campaign.