c0df9fbe[.]vivewss[.]pages[.]dev

This domain, c0df9fbe.vivewss.pages.dev, is a confirmed phishing site targeting Ledger, a cryptocurrency hardware wallet brand. As of the report date of July 24, 2026, the domain is offline, having been taken down. The investigation reveals a clear and elevated threat. The domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating broad detection across the security community. It also appears on one security blocklist and is blocked by PhishDestroy, a service dedicated to dismantling phishing infrastructure. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trustworthiness.

The page title was recorded as 'Ledger Live', which is the name of Ledger's official companion application, confirming the brand impersonation. The scam type is classified as a crypto scam. Infrastructure analysis shows the domain was hosted behind Cloudflare, Inc. (AS13335) with an IP address of 172.66.47.78, located in the United States. The SSL certificate was issued by Google Trust Services (WE1), which is standard for sites using Cloudflare. The HTTP status code returned was 403, indicating access was forbidden, likely due to the site being taken offline or blocked. Technologies detected include HSTS, Cloudflare, and HTTP/3.

The domain was registered through Cloudflare, Inc., and the nameservers were not found (NS_NOT_FOUND), which is consistent with a domain that has been suspended or removed. The exact content of the phishing page has not been analyzed in this report, but the page title and brand target clearly indicate an attempt to steal cryptocurrency credentials or seed phrases from Ledger users. Defenders should ensure that this domain is blocked at the network level and that any users who may have visited it are warned. Given the domain is offline, the immediate risk is mitigated, but similar domains using the same infrastructure pattern may emerge. Monitoring for variations of 'vivewss.pages.