ledgerlivelog-en-us[.]pages[.]dev

Analysis of ledgerlivelog-en-us.pages.dev indicates a brand‑impersonation campaign targeting Ledger users. The domain was registered through Cloudflare, Inc. and is hosted on Cloudflare’s network (ASN 13335, United States). DNS resolution points to IP address 172.66.47.178, which is owned by Cloudflare. The site presents a Google Trust Services / WE1 SSL certificate, confirming that TLS termination is performed by Cloudflare’s edge infrastructure.

Nameserver records list alexandra.ns.cloudflare.com and keaton.ns.cloudflare.com, consistent with the registrar’s service. HTTP requests return a 403 status code, and the domain is currently taken offline, limiting direct content inspection. The page title retrieved from the server reads "ledegr-live-en — Complete Guide," but no further page content has been captured. Security telemetry shows the domain appears on one blocklist and is blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of malicious intent. VirusTotal analysis reports that 2 of 91 scanning engines flagged the domain, reinforcing the suspicion. Defenders should add ledgerlivelog-en-us.pages.dev to URL filtering and DNS blocklists, monitor for any re‑activation of the host, and enforce strict outbound controls to prevent credential leakage to impersonated Ledger services. Continuous observation of Cloudflare‑hosted domains with similar naming patterns is advised, as the infrastructure can be reused for future impersonation attempts.