qas-ledger-lives[.]pages[.]dev

The domain qas-ledger-lives.pages.dev was registered on March 24, 2026 through Cloudflare, Inc. and is currently taken offline, returning HTTP 403 responses. Infrastructure analysis shows the site was hosted behind Cloudflare’s network (IP 172.66.47.103, located in Canada) and employed modern transport features including HTTP/3 and HTTP Strict Transport Security. The TLS certificate was issued by Google Trust Services under the WE1 root, indicating a valid, publicly trusted certificate chain. DNS resolution used Cloudflare‑managed name servers julissa.ns.cloudflare.com and thaddev.ns.cloudflare.com.

Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. VirusTotal scans recorded 15 detections out of 94 scanning engines, and PhishDestroy has listed the domain as blocked. The page title observed during scanning, “Ledger Live – Real‑Time Crypto Tracking,” directly references Ledger’s branded product, confirming a brand‑impersonation intent consistent with the classified crypto‑scam type.

While the site is no longer serving content, the combination of a legitimate‑looking certificate, Cloudflare hosting, and the Ledger‑specific title suggests a deliberate attempt to lure Ledger users into credential harvesting or fund diversion. Defenders should continue to block the domain at network perimeter, monitor for any re‑registration attempts, and update endpoint and email filters with indicators of compromise derived from the observed IP, name servers, and the observed page title. Further investigation should focus on any associated URLs or phishing kits that may have been distributed before the takedown, as the current evidence does not reveal the exact payload or credential capture mechanism.