secure-ledger-live-app[.]pages[.]dev

The domain secure-ledger-live-app.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2a06:98c1:3120::3, which is hosted by Cloudflare (AS13335) in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content is blocked by the provider. Technical fingerprints show the presence of HSTS, Cloudflare services, and HTTP/3, confirming that the infrastructure is fully cloud‑based. The SSL certificate is issued by Google Trust Services under the WE1 label, matching the Cloudflare front‑end.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and a detection rate of 14 out of 93 security vendors on VirusTotal flagging the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation platform. The page title, brand target (Ledger), and declared scam type (Crypto Scam) collectively indicate a brand‑impersonation campaign aimed at deceiving Ledger users. Current status is offline, suggesting that the phishing content has been removed or the site has been taken down.

Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the Cloudflare block page has been observed. Defenders should add the IPv6 address and the full domain to network‑level deny lists, monitor for future subdomains using the "secure‑ledger‑live‑app" prefix, and ensure that endpoint protection solutions are updated to reflect the 14 vendor detections. Continuous observation of Cloudflare‑registered domains targeting Ledger and related crypto services is recommended to pre‑empt similar impersonation attempts.