ledger-liv-e-1xx[.]pages[.]dev

Analysis of the domain ledger-liv-e-1xx.pages.dev indicates a confirmed wallet seed-phishing operation targeting Trezor hardware wallet users. The domain, registered on February 21, 2026, through Cloudflare, Inc., impersonates the official Trezor setup process as evidenced by the page title 'Trezor.io/Start® - Starting Up Your Device | Trezor®.' Infrastructure analysis reveals the site resolves to IP 188.114.96.3, hosted on Cloudflare's network (AS13335) in the US, with nameservers arya.ns.cloudflare.com and lex.ns.cloudflare.com. The domain employs security technologies including HSTS, HTTP/3, and a Google Trust Services SSL certificate (WE1), which are consistent with legitimate services but frequently abused by phishing actors to appear credible. Detection data shows the domain is flagged by one security vendor on VirusTotal and appears on one security blocklist, while PhishDestroy has already blocked access.

Trust scores from Scamadviser (41/100) and Gridinsoft (0/100) further support its malicious classification. The site returned an HTTP 403 status at the time of assessment, suggesting it may have been taken offline or restricted following detection. The scam type is explicitly categorized as wallet/seed phishing, a method used to harvest recovery phrases from cryptocurrency wallet users.

While the domain's current offline status limits further live analysis, the available evidence—including the deceptive page title, registration details, hosting infrastructure, and detection by security vendors—confirms its role in a seed-phishing campaign. Defenders should treat this domain as malicious, block it at the network level, and monitor for related infrastructure or similar impersonation attempts targeting Trezor or other wallet brands. No visual or behavioral analysis of the site is available, but the technical indicators align with known phishing patterns in the cryptocurrency space.