faq-live-ladger[.]pages[.]dev

Analysis of the domain faq-live-ladger.pages.dev indicates a crypto scam campaign impersonating Ledger, a cryptocurrency hardware wallet provider. The domain was registered on March 23, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.109, which is geolocated to Canada and associated with Cloudflare's infrastructure. The nameservers evan.ns.cloudflare.com and liz.ns.cloudflare.com further confirm Cloudflare as the hosting and DNS provider. At the time of assessment, the domain returned an HTTP 403 status, suggesting access restrictions or takedown measures, and is currently offline. The page title, 'Ledger Live Desktop® | Secure Crypto Management Platform®,' directly mimics Ledger’s official branding, aligning with the reported scam type of a crypto scam.

Detection data from security vendors indicates elevated risk: 11 of 94 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain is also blocked by PhishDestroy, a specialized anti-phishing service. Infrastructure analysis reveals the use of Cloudflare’s content delivery network, including HTTP/3 and HSTS, which are legitimate technologies but frequently leveraged by threat actors to obscure malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently indicate malicious intent but is often exploited in phishing campaigns due to its widespread trust.

While the domain is currently offline, defenders should treat it as part of an active brand impersonation campaign targeting Ledger users. Organizations are advised to block the domain and its resolving IP (172.66.47.109) at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the risk of crypto-themed phishing.