live-ledger-en-us-dnq[.]pages[.]dev

Analysis of the domain live-ledger-en-us-dnq.pages.dev indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain, registered through Cloudflare, Inc. on September 24, 2025, resolves to the IP address 172.66.44.110, hosted on Cloudflare's infrastructure in Canada. Nameservers carlos.ns.cloudflare.com and lindsey.ns.cloudflare.com further confirm Cloudflare as the provider. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare's standard configuration, though this does not mitigate the domain's malicious intent. The page title, 'Ledger Live Integrations - Ledger Developer Portal,' explicitly mimics Ledger's official developer resources, suggesting an attempt to deceive users into interacting with fraudulent content. As of July 12, 2026, the domain remains active, returning an HTTP 200 status code, and is flagged by at least one security blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. VirusTotal reports detection by 16 of 91 security vendors, though the specific nature of these detections is not detailed in available intelligence. Infrastructure analysis reveals the use of HTTP/3 and HSTS, technologies commonly employed to enhance performance and security, though in this context, they may serve to lend an appearance of legitimacy. The domain's registration date, nearly nine months prior to this report, suggests prolonged operation or delayed detection. Defenders are advised to block the domain and its resolving IP at network and endpoint levels. Further investigation into associated wallet addresses or redirect chains is recommended to identify potential secondary payloads or exfiltration points. The exact content of the site remains unanalyzed, and no specific scam mechanics (e.g., crypto drainer, credential harvesting) are confirmed beyond its classification as a crypto scam.