ledger-live-app-ask[.]pages[.]dev

This domain, ledger-live-app-ask.pages.dev, is assessed as an elevated-risk phishing site targeting cryptocurrency users through brand impersonation of Ledger, a hardware wallet provider. Registered on February 21, 2026, via Cloudflare, the domain was taken offline following detection and blocking by PhishDestroy. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers ulla.ns.cloudflare.com and weston.ns.cloudflare.com, resolving to IP 172.66.47.89 in the US. The SSL certificate is issued by Google Trust Services (WE1), and the site employed HSTS and HTTP/3 technologies.

At the time of assessment, the domain returned an HTTP 403 status, indicating access restrictions or takedown. The page title, 'Ledger Live App - Secure Crypto Management,' aligns with known wallet phishing tactics, specifically seed phrase or private key theft, as classified in the scam type 'Wallet/Seed Phishing.' The domain appears on one security blocklist, and six of 93 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigned a trust score of 0/100, further corroborating its fraudulent nature. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, phishing classification, and detection by multiple security vendors confirms its malicious intent.

Defenders should treat this domain as confirmed malicious and prioritize blocking or monitoring any residual connections. Given its offline status, focus should shift to identifying related infrastructure, such as shared IPs, SSL certificates, or registrant details, to preemptively disrupt potential successor domains. If internal logs indicate prior user interaction with this domain, initiate incident response procedures for potential credential or seed phrase exposure. No further action is required for this specific domain unless new activity is detected.