ledger-live-login-us[.]pages[.]dev

The domain ledger-live-login-us.pages.dev was used for brand impersonation, specifically targeting Ledger, a well-known cryptocurrency wallet provider. This site functioned as a phishing scam aimed at deceiving users into sharing sensitive information under the guise of a legitimate Ledger login portal. The website is currently offline and no longer poses an immediate risk, but it was previously active as a threat.

Technical analysis shows that ledger-live-login-us.pages.dev was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.47.32 located in the US (AS13335 Cloudflare, Inc.). The domain's SSL certificate was issued by Google Trust Services / WE1, and the nameservers were peaches.ns.cloudflare.com and leland.ns.cloudflare.com. VirusTotal detected phishing activity, with 2 of 95 vendors (Fortinet and Webroot) flagging the site. The site appeared on one security blocklist (PhishDestroy) and had a Gridinsoft trust score of 0/100. At the time of review, the HTTP status was 403, and the page title displayed 'Suspected phishing site | Cloudflare.'

If users interacted with ledger-live-login-us.pages.dev and entered Ledger credentials, immediate action is recommended: change passwords associated with Ledger accounts, enable two-factor authentication, and closely monitor for unauthorized transactions or fraud. Users should report any phishing attempts impersonating Ledger to the real Ledger support team and relevant authorities. Remaining vigilant against cryptocurrency phishing scams and confirming site legitimacy before entering sensitive information are essential steps for ongoing security.