doce-ldger-live[.]pages[.]dev

The domain doce-ldger-live.pages.dev was registered on March 24, 2026 and is currently hosted behind Cloudflare infrastructure, resolving to the IP address 188.114.97.3 located in Canada. DNS resolution uses the Cloudflare-authoritative nameservers ursula.ns.cloudflare.com and will.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 authority, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. The page title returned by the server is "Ledger® Live:- Secure Crypto Management", indicating a direct attempt to mimic the official Ledger Live service. VirusTotal scans show that three of ninety‑four security vendors flagged the domain, and it appears on a single security blocklist that has already been enacted by PhishDestroy. The risk rating is high, and the threat type is classified as brand impersonation targeting the Ledger brand. While the HTTP response code is 403, the presence of a valid TLS certificate and Cloudflare‑provided security headers suggests an active infrastructure designed to appear legitimate. Concrete evidence of malicious payloads or credential‑stealing forms has not been observed, and the exact content beyond the title remains unverified. Defenders should block the domain at the network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and educate users about unsolicited requests claiming to be Ledger Live. Continuous scanning for re‑registration attempts and inclusion in internal threat‑intel feeds are recommended to mitigate potential credential‑ harvesting or crypto‑related scams.