access-liveledgr-eng[.]pages[.]dev

The domain access-liveledgr-eng.pages.dev is currently active and has been classified as a brand‑impersonation campaign targeting Ledger. The site was registered on 2026‑03‑29 through Cloudflare, Inc., and uses Cloudflare’s authoritative nameservers augustus.ns.cloudflare.com and kia.ns.cloudflare.com. DNS resolution points to IP 172.66.44.89, which is hosted in Cloudflare’s network (CA). HTTPS is served with a Google Trust Services / WE1 certificate and the server advertises HSTS and HTTP/3, returning HTTP 200 for the root URL. The page title returned by the server is “Ledger® Live - Crypto™ Wallet App | Ledger®”, matching the declared brand target. Threat intelligence flags the domain on a single security blocklist and it is listed as blocked by PhishDestroy. VirusTotal analysis shows five of ninety‑four scanners flag the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk assessment. The observable indicators confirm a malicious infrastructure, but the exact payload, credential‑harvesting mechanisms, and user‑facing content have not been publicly disclosed. Defenders should immediately block the domain and associated IP at perimeter and DNS layers, monitor for related Cloudflare‑hosted sub‑domains, and apply URL filtering rules that reference the observed page title and SSL certificate details. Ongoing collection of behavioural data is recommended to refine detection signatures.