ledger-live-dm[.]pages[.]dev

Analysis of ledger-live-dm.pages.dev shows a newly registered domain (creation date February 21, 2026) that was provisioned through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 104.21.64.1, located in the United States under ASN 13335. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns HTTP 403, indicating that the original content is no longer accessible. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid TLS handshake but offering no legitimacy for the underlying service. Trust scoring services assign extremely low reputations: Gridinsoft reports 0/100 and Scamadviser 1/100.

VirusTotal scans flagged the domain by 11 of 95 vendors, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the host. Detected technologies include HTTP/3, HSTS, and generic Cloudflare services; no additional application stack is revealed.

The brand target is Ledger, and the scam type is classified as a crypto scam, suggesting the domain was intended to lure cryptocurrency users by mimicking Ledger communications. Defenders should immediately add the domain and its associated IP address to local block lists, monitor for any resurgence of the host under alternative subdomains, and enforce strict email and web filtering for Ledger‑related keywords. Continuous observation of Cloudflare‑registered domains created after early 2026 is advisable, as the rapid provisioning of new hosts can facilitate short‑lived impersonation campaigns before takedown.