ledger-livce-login[.]pages[.]dev

Analysis of ledger-livce-login.pages.dev indicates a brand‑impersonation campaign targeting Ledger users. The site was created on 21 February 2026 and is registered through Cloudflare, Inc. It resolves to the Cloudflare edge address 172.66.44.136, located in the United States under ASN 13335 (Cloudflare, Inc.). The TLS certificate is issued by Google Trust Services / WE1, and the service employs HSTS, Cloudflare protection, and HTTP/3. An HTTP 403 response was observed before the site was taken offline, and the page title returned by the server is "Suspected phishing site | Cloudflare".

The domain is listed on a single security blocklist and has been blocked by PhishDestroy. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 / 100. VirusTotal scans show that two of ninety‑three security vendors flagged the domain, confirming malicious intent.

The campaign is classified as a crypto scam and explicitly impersonates the Ledger brand. Defenders should immediately block the domain at DNS and proxy layers, monitor traffic to the associated Cloudflare IP for any residual activity, and add the domain to internal threat‑intel feeds. Continuous observation of related Cloudflare‑hosted infrastructure is advised, as attackers may shift to adjacent subdomains or reuse the same hosting assets for future impersonation attempts.