ledger-live-lo-gin-axf[.]pages[.]dev

Analysis of the domain ledger-live-lo-gin-axf.pages.dev indicates a crypto scam impersonating Ledger, a hardware cryptocurrency wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare's infrastructure (AS13335), resolving to IP 172.66.45.36. As of July 24, 2026, the domain returns an HTTP 403 status, and its page title is 'Suspected phishing site | Cloudflare,' suggesting it has been flagged by the hosting provider. The domain appears on one security blocklist and is blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Ten of 95 security vendors on VirusTotal flag the domain as malicious, though the specific detection logic is not detailed in the available data. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, and the domain employs HSTS and HTTP/3 technologies, which are not inherently indicative of malicious intent but are frequently used by threat actors to lend credibility. Nameservers are Cloudflare-hosted (arya.ns.cloudflare.com and lex.ns.cloudflare.com), consistent with the registrar.

The domain's current offline status limits further analysis of its operational content, but its naming convention—mimicking Ledger Live, the official Ledger application—strongly suggests an intent to deceive users into divulging cryptocurrency wallet credentials or other sensitive information. Defenders should treat this domain as malicious and prioritize blocking it at the network level, particularly in environments where Ledger products are used. Monitoring for related domains using similar naming patterns (e.g., 'ledger-live', 'login', or 'account-verification' variations) is recommended, as this appears to be part of a broader impersonation campaign.