sso-ledger-livee[.]pages[.]dev

Analysis of sso-ledger-livee.pages.dev indicates a confirmed crypto scam impersonating Ledger, a hardware wallet provider. The domain was registered on March 23, 2026, through Cloudflare, Inc., and resolved to IP 188.114.96.3, hosted on Cloudflare’s infrastructure in Canada. Nameservers jean.ns.cloudflare.com and milan.ns.cloudflare.com further confirm Cloudflare as the hosting and DNS provider. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard configuration, though this does not mitigate the domain’s malicious intent.

Security vendors flagged the domain as malicious, with 12 of 94 engines on VirusTotal detecting it as harmful. It also appears on one security blocklist, and Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The page title, 'Ledger Live | Manage, Buy,' directly mimics Ledger’s official branding, aligning with the reported scam type of a crypto scam. The domain was taken offline following detection, with a current HTTP status of 403, indicating access is now restricted.

Infrastructure analysis reveals the use of HSTS and HTTP/3, common in modern phishing campaigns to appear legitimate. While the exact content of the site remains unanalyzed, the combination of brand impersonation, crypto scam classification, and security vendor detections provides concrete evidence of malicious activity. Defenders should treat this domain as compromised and block it at the network level, while monitoring for related domains using similar naming conventions or Cloudflare-hosted infrastructure. The domain’s offline status suggests mitigation efforts were successful, but vigilance is advised for potential re-emergence or copycat sites.