3db4ea20[.]leger-dpk[.]pages[.]dev

This domain, 3db4ea20.leger-dpk.pages.dev, is flagged as part of a crypto scam infrastructure impersonating Ledger, a cryptocurrency hardware wallet provider. Registered on September 2, 2020, through Cloudflare, Inc., the domain exhibits multiple indicators of malicious activity. Infrastructure analysis reveals it is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 172.66.44.217, located in the US. The domain’s nameservers (adi.ns.cloudflare.com and karl.ns.cloudflare.com) and SSL certificate (issued by Google Trust Services / WE1) align with Cloudflare’s standard configuration, though this does not mitigate the risk of abuse. The page title, 'Ledger Live,' directly corresponds to Ledger’s official software, reinforcing the domain’s role in brand impersonation.

As of the report date, the domain returns an HTTP 403 status, indicating it is either restricted or taken offline, though this does not preclude prior malicious use. Detection data from security vendors is limited but notable: 13 of 95 vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk. The domain is also blocked by PhishDestroy, a specialized anti-phishing service.

While the exact content of the site is not analyzed, the combination of brand impersonation, crypto scam classification, and detection by multiple security vendors confirms its malicious intent. Defenders should treat this domain as compromised infrastructure and prioritize blocking it at the DNS or network level. Given its association with Ledger, organizations handling cryptocurrency transactions should monitor for related phishing attempts or credential harvesting activity linked to this domain. The domain’s current offline status may indicate temporary takedown or evasion, but historical use in scams warrants continued vigilance.