ledger-dxdlive[.]pages[.]dev

Analysis of ledger-dxdlive.pages.dev shows a domain created on February 21, 2026 and hosted behind Cloudflare’s network (AS13335). The domain resolves to the IPv6 address 2606:4700:310c::ac42:2fb7, which is owned by Cloudflare, Inc., and the hosting environment presents HSTS, Cloudflare services, and HTTP/3 support. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the malicious intent. An HTTP request to the site returns a 403 status code and the page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the content has been flagged by Cloudflare’s own detection mechanisms.

VirusTotal reports that 10 of 93 scanned security vendors flag the domain, reinforcing the suspicion of malicious activity. Reputation services assign low trust scores: Scamadviser rates the site 41 out of 100, while Gridinsoft records a score of 0 out of 100, and the domain appears on a single security blocklist. The domain is listed as blocked by the PhishDestroy feed and is currently taken offline, suggesting that mitigation actions have already been applied. The threat is classified as a crypto scam that impersonates the Ledger brand, a well‑known hardware wallet provider, and the domain’s naming pattern (ledger‑dxdlive) aligns with typical brand‑spoofing tactics.

While the exact phishing page content has not been captured, the combination of brand impersonation, low reputation metrics, vendor detections, and Cloudflare‑generated phishing warning provides sufficient confidence to treat the domain as a high‑confidence Ledger impersonation. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and add the IPv6 address to threat‑intel feeds.