ledger--live---login[.]pages[.]dev

The domain ledger--live---login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline with an HTTP 403 response. DNS resolution points to IP 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), and the HTTP headers indicate the use of HSTS, Cloudflare edge services, and HTTP/3. The page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the domain has been flagged by Cloudflare’s protective mechanisms.

Security‑vendor telemetry shows that 10 of 93 VirusTotal scanners have flagged the domain, and the site appears on a single external blocklist. Independent reputation services assign extremely low scores: Gridinsoft rates it 0 / 100 and Scamadviser 1 / 100, reflecting a high confidence of malicious intent. PhishDestroy has also added the domain to its block list, and the classification in the intelligence feed is "Crypto Scam" with a specific brand impersonation of Ledger.

The available evidence establishes a clear pattern of brand‑targeted fraud: the domain name incorporates the Ledger brand and uses sub‑domains that mimic legitimate login URLs, a known technique for credential harvesting in the cryptocurrency ecosystem. However, no direct content analysis or screenshot is available beyond the generic page title, leaving the exact phishing payload unconfirmed.

Defenders should treat ledger--live---login.pages.dev as a confirmed malicious indicator. Recommended actions include adding the domain to DNS and proxy blocklists, updating intrusion‑detection signatures to flag any HTTP request to the resolved IP address, and monitoring for similar Ledger‑related impersonation domains created after February 2026. Continuous re‑evaluation is advised in case the domain is re‑activated or new content surfaces.