sa-ledger-live[.]pages[.]dev

Analysis of sa-ledger-live.pages.dev indicates a credential‑harvesting site that impersonates the Ledger brand. The domain was created on March 22, 2026 and is registered through Cloudflare, Inc., with authoritative nameservers aaron.ns.cloudflare.com and leah.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, an address owned by Cloudflare, Inc. and geolocated to Canada. The site presents a valid SSL certificate issued by Google Trust Services (WE1), and the HTTP response returns a 403 status code while HSTS and HTTP/3 are enforced, suggesting a deliberately restrictive configuration.

The page title "Ledger Live | Secure Crypto Management" aligns with the declared brand target, Ledger, and the scam type is identified as a crypto scam. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host, and VirusTotal reports that 9 of 94 scanning engines flag the domain as malicious.

The combined evidence—brand‑specific page title, low trust score, blocklist presence, and multiple vendor detections—supports an elevated risk rating. Defenders should block outbound connections to 188.114.96.3, add the domain to internal blocklists, and monitor for similar Cloudflare‑hosted impersonation attempts targeting Ledger users. Further investigation is limited by the current offline status of the site, but the existing indicators provide sufficient justification for proactive mitigation.