8674b351[.]memo-ba1[.]pages[.]dev

Analysis of 8674b351.memo-ba1.pages.dev shows a high‑risk, brand‑impersonation operation targeting Ledger users. The domain resolves to IP 172.66.46.227, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Infrastructure inspection reveals Cloudflare‑provided services, including HTTP/3 support, HSTS enforcement, and a TLS certificate issued by Google Trust Services (WE1). The site’s page title is "Ledger Live," directly matching the Ledger brand, confirming the impersonation claim.

Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal reports that 16 of 95 scanned security vendors flag the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Additional reputation data shows a Gridinsoft trust score of 0 / 100 and a missing nameserver entry (NS_NOT_FOUND).

The HTTP response returned a 403 status code, and the current status is recorded as taken offline. Given the confluence of brand impersonation, a low trust score, multiple vendor detections, and confirmed blocklist presence, defenders should immediately add the domain and its hosting IP to deny‑list rules, monitor for any re‑hosting attempts, and enforce URL filtering for Ledger‑related traffic. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is advised, as the infrastructure can be reused for future impersonation campaigns.