ledger----live[.]pages[.]dev

Analysis indicates that the domain ledger----live.pages.dev was created on 21 February 2026 and is hosted behind Cloudflare's network (AS13335) with the IP address 172.66.44.101 located in the United States. The domain is registered through Cloudflare, Inc. and uses the authoritative nameservers lia.ns.cloudflare.com and ignat.ns.cloudflare.com. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, suggesting that access is being blocked by the hosting provider. SSL termination is performed by Google Trust Services under the WE1 certificate, and the connection enforces HSTS while supporting HTTP/3, confirming a modern Cloudflare‑enabled configuration.

Threat intelligence classifies the site as a crypto‑related brand impersonation targeting Ledger. The page is listed on one public blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis shows that 2 of 93 scanning engines have flagged the domain, reinforcing the suspicion of malicious intent. A Gridinsoft trust score of 0 / 100 further indicates a lack of legitimacy.

No additional behavioral telemetry is available because the site is currently offline, limiting direct observation of payloads or credential‑harvesting forms. Defenders should continue to deny any network traffic to ledger----live.pages.dev, add the domain to internal blocklists, and monitor for derivative subdomains that may be created using the same Cloudflare account. Given the confirmed impersonation of the Ledger brand and the presence of multiple security vendor detections, the domain should be treated as high‑risk for credential or crypto‑asset theft. Ongoing reconnaissance of the associated Cloudflare account and correlation with other Ledger‑related phishing campaigns is recommended to pre‑empt future infrastructure reuse.