ldger--live-en-us[.]pages[.]dev

Analysis of ldger--live-en-us.pages.dev indicates an active brand‑impersonation campaign targeting Ledger users. The domain was registered on 30 April 2026 through Cloudflare, Inc. and resolves to IP 172.66.47.122, a Cloudflare edge location in Canada. DNS resolution uses the Cloudflare nameservers kianchau.ns.cloudflare.com and nia.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3, consistent with typical Cloudflare‑hosted infrastructure. The only publicly visible page title is “Ledger Live Wallet® | Official Crypto Management Platform,” directly referencing the Ledger brand. Gridinsoft assigns a trust score of 0/100, and the domain is listed on one external blocklist and has been blocked by PhishDestroy. No detections were reported by VirusTotal, but the absence of alerts does not constitute validation of safety. Current evidence does not reveal credential‑collection forms or malicious payloads; the observed indicators are limited to domain registration, hosting, and brand‑related page title. Defenders should treat the domain as malicious, block DNS and HTTP traffic to the host, and monitor for any future payload delivery. Ongoing investigation should focus on capturing the landing page content, identifying any phishing infrastructure, and correlating traffic with known Ledger‑related credential‑theft campaigns.