ledgerlive-en-us[.]pages[.]dev

Analysis of ledgerlive-en-us.pages.dev shows a confirmed impersonation of the Ledger brand aimed at cryptocurrency victims. The domain was registered through Cloudflare, Inc. on February 21, 2026 and is hosted on Cloudflare's network (AS13335) with the resolving IP address 172.66.45.17 located in the United States. Technical fingerprints include enforced HSTS, use of HTTP/3, and a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a standard Cloudflare SSL deployment. An HTTP request to the site returns a 403 status code and the page title is "Suspected phishing site | Cloudflare," confirming that the content has been flagged by Cloudflare's protection services.

Reputation scoring is extremely low, with a Gridinsoft trust score of 0 out of 100, and the domain appears on one security blocklist. It has been actively blocked by PhishDestroy, and VirusTotal reports that 11 of 93 scanned security vendors flagged the domain as malicious, reinforcing the threat assessment. The site is currently offline, as indicated by its status and the blocklist entry, but its recent creation date suggests it may be part of a rapid‑deployment campaign targeting Ledger users with crypto‑related scams.

Defenders should immediately add ledgerlive-en-us.pages.dev to URL filtering and DNS block lists, monitor Cloudflare‑hosted IP ranges for similar rapid‑registration patterns, and enforce credential‑reuse protection for Ledger account logins. Continuous threat‑intel feeds should be consulted for new subdomains or variations that reuse the same Cloudflare nameservers (adaline.ns.cloudflare.com, trace.ns.cloudflare.com). Given the low trust score, blocklist presence, and vendor detections, the domain should be treated as high‑confidence malicious and excluded from all user‑facing traffic.