ldger--live-site[.]pages[.]dev

The domain ldger--live-site.pages.dev is actively impersonating the Ledger brand, specifically through its page titled 'Ledger Live | Secure'. This domain was created on March 31, 2026, and has since been flagged on one security blocklist, indicating a recognized threat. The domain resolves to the IP address 188.114.97.3 and has been assigned a trust score of 0 out of 100 by Gridinsoft, underscoring its malicious nature. It is currently active and continues to pose a significant risk to individuals and organizations associated with the Ledger brand.

The domain is associated with Cloudflare, Inc., which is responsible for its registration and hosting, utilizing technologies such as HSTS, Cloudflare's services, and HTTP/3 protocols. The presence of an SSL certificate issued by Google Trust Services might mislead users into believing the domain is legitimate. However, analysis of its reputation reveals that 9 out of 95 security vendors on VirusTotal have flagged this domain, confirming its association with malicious activities. Furthermore, the domain has been blocked by PhishDestroy, an indication of its active detection and prevention measures taken by security entities.

Given the observed data, it is advised that defenders monitor for any interactions with this domain, especially among users who may be targeted by social engineering tactics associated with the Ledger brand. Organizations should implement email filtering and web protection measures to prevent access to this domain. Continuous vigilance against brand impersonation tactics is essential, particularly when a domain presents itself with deceptive titles and security features. The ongoing monitoring of the associated IP address and the registrar could yield further intelligence relevant to mitigation efforts against such impersonation campaigns.