ledger-live-en-help[.]pages[.]dev

The domain ledger-live-en-help.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3 located in the United States under ASN 13335. The domain is served by Cloudflare’s infrastructure, presenting HSTS, HTTP/3 and a TLS certificate issued by Google Trust Services (WE1). An HTTP 403 response is returned when the site is accessed, and the page title presented by Cloudflare is “Suspected phishing site | Cloudflare”. The site is flagged by PhishDestroy and appears on one security blocklist. Trust scores are extremely low: Gridinsoft assigns 0/100 and Scamadviser 10/100.

VirusTotal analysis shows that four of ninety‑three security vendors flagged the domain, indicating some level of malicious detection. The domain is classified as a crypto‑related scam and explicitly impersonates the Ledger brand. Nameservers are angela.ns.cloudflare.com and cody.ns.cloudflare.com. The current operational status is offline, and the domain has been taken down. Based on the available evidence, defenders should treat the domain as a high‑confidence indicator of a Ledger‑related credential‑ harvesting campaign.

Network defenses should block outbound connections to 188.114.97.3 and any sub‑domains of pages.dev that resolve to the same Cloudflare IP range. Email filters should add the full domain to deny lists and monitor for any messages referencing Ledger support URLs that contain the “ledger‑live‑en‑help” pattern. Threat‑intel feeds should be updated to reflect the 21 February 2026 registration date and the association with the Crypto Scam category. Continuous monitoring of Cloudflare‑hosted domains for similar naming conventions is recommended, as the attacker may reuse the same infrastructure for future impersonation attempts. Until the domain is confirmed benign, no legitimate traffic should be allowed.