en-us-ledger-live[.]pages[.]dev

Analysis of the domain en-us-ledger-live.pages.dev indicates it is a confirmed brand-impersonation scam targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered through Cloudflare, Inc. on September 2, 2020, and resolves to the IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (adi.ns.cloudflare.com, karl.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern web hosting but do not inherently indicate malicious intent. As of July 24, 2026, the domain has been flagged by 10 of 93 security vendors on VirusTotal, and it appears on at least one security blocklist. The Gridinsoft trust score for this domain is 0 out of 100, further supporting its classification as malicious.

The page title, 'Suspected phishing site | Cloudflare,' aligns with its current offline status, as the domain returns an HTTP 403 error, indicating access is forbidden. This suggests the domain may have been suspended or taken down by Cloudflare or the registrar following reports of fraudulent activity. The scam type is explicitly identified as a crypto scam, which correlates with the impersonation of Ledger, a known target for phishing campaigns aimed at stealing cryptocurrency credentials or private keys. The SSL certificate is issued by Google Trust Services (WE1), which is a legitimate certificate authority, but the presence of a valid SSL certificate does not mitigate the domain's malicious nature. No evidence of a specific phishing kit or additional infrastructure details (e.g., redirects, associated domains) is currently available in the provided intelligence.

Defenders should treat this domain as high-risk and ensure it is blocked at the network and endpoint levels.