us-live-ledger-download[.]pages[.]dev

This domain, us-live-ledger-download.pages.dev, was identified as part of a crypto scam infrastructure impersonating Ledger, a hardware wallet provider. Registered on March 22, 2026, through Cloudflare, Inc., the domain resolved to 188.114.97.3, an IP address geolocated to Canada and associated with Cloudflare's network. The page title, 'Ledger Live Desktop: Official Download,' directly mimics Ledger's legitimate software distribution, suggesting intent to deceive users into downloading malicious payloads. Analysis indicates the domain was hosted behind Cloudflare's security proxy, utilizing HSTS, HTTP/3, and a valid SSL certificate issued by Google Trust Services (WE1), which may have contributed to evading initial detection.

As of July 24, 2026, the domain is offline, returning an HTTP 403 status. Security vendor assessments show limited but clear indicators of compromise: 11 of 94 vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The domain's nameservers (cosmin.ns.cloudflare.com, tina.ns.cloudflare.com) are consistent with Cloudflare's infrastructure, a common choice for phishing operators due to its ease of deployment and built-in protections.

Defenders should treat this domain as confirmed malicious infrastructure targeting cryptocurrency users. While the site is currently offline, the registration details, hosting provider, and detection history suggest it may resurface or be replaced by similar domains. Network-level blocking of the resolved IP (188.114.97.3) and monitoring for newly registered Cloudflare-hosted domains with 'ledger' or 'live' in the subdomain are recommended. No evidence of a specific phishing kit or payload delivery mechanism is available, so further analysis of archived captures or related domains may be necessary to determine the full scope of the campaign.