ledger-live-wall-et[.]pages[.]dev

Analysis of the domain ledger-live-wall-et.pages.dev indicates it was actively impersonating Ledger, a hardware cryptocurrency wallet provider, as part of a crypto scam campaign. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolved to the IP address 172.66.47.3, associated with Cloudflare's infrastructure (AS13335) in the United States. Nameservers max.ns.cloudflare.com and rayne.ns.cloudflare.com further confirm Cloudflare as the hosting and DNS provider, while the SSL certificate issued by Google Trust Services (WE1) aligns with Cloudflare's standard security practices. Detection data reveals elevated risk: nine of ninety-three security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist.

Scamadviser and Gridinsoft assigned trust scores of 1/100 and 0/100, respectively, reinforcing its classification as a high-risk entity. The domain's HTTP status returned a 403 Forbidden response at the time of analysis, and Cloudflare's interstitial page labeled it as a 'Suspected phishing site,' though the exact content of the phishing page remains unconfirmed due to its offline status. Infrastructure analysis reveals the use of HTTP/3 and HTTP Strict Transport Security (HSTS), common in modern web deployments but also leveraged by threat actors to lend legitimacy to malicious sites. The domain's creation date, six months prior to this report, suggests it may have been part of a broader, pre-planned campaign rather than an opportunistic attack.

While the specific phishing kit or payload is not identified in available data, the domain's association with a crypto scam aligns with known tactics targeting cryptocurrency users through brand impersonation. Defenders are advised to block the domain and its resolving IP (172.66.47.3) at the network level, monitor for related subdomains under *.pages.dev, and alert users to the risk of Ledger-branded phishing attempts.