cecd0130[.]sstrpp[.]pages[.]dev

Analysis of cecd0130.sstrpp.pages.dev indicates a high‑risk brand‑impersonation infrastructure targeting Ledger’s Ledger Live service. The domain, created on 2 September 2020, is hosted behind Cloudflare’s network (ASN 13335) and resolves to the IP address 172.66.45.7 located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 authority, confirming the use of legitimate SSL issuance but not the legitimacy of the content. HTTP requests receive a 403 response, and the page title returned is “Ledger Live”, matching the branded target.

The site employs Cloudflare security features including HSTS and HTTP/3, which can obscure direct server fingerprinting. Reputation data shows the domain appears on one security blocklist and has been flagged by Google Safe Browsing for social‑engineering content. VirusTotal analysis reports 14 of 93 scanning engines flagging the domain, suggesting the presence of malicious components. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy lists the domain as blocked, reinforcing the malicious classification.

The domain is identified as a crypto‑scam that impersonates Ledger, yet the exact payload or credential‑stealing mechanisms have not been observed because the site is currently offline. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host or similar sub‑domains, and incorporate the IP address and ASN into threat intelligence feeds. Because the infrastructure relies on Cloudflare’s shared hosting, future variants may reuse the same provider; vigilance for new domains registered with similar naming patterns and pointing to the same IP range is advisable. Until the site is confirmed inactive, security teams should treat any traffic to the domain as malicious.