live-ledggcom[.]pages[.]dev

Analysis of live-ledggcom.pages.dev indicates that the domain was registered on April 2 2026 through Cloudflare, Inc. and is currently active. DNS resolution points to IP address 188.114.96.3, which belongs to Cloudflare’s network in Canada. The authoritative name servers are theo.ns.cloudflare.com and ziggy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, suggesting that the attacker has obtained a legitimate certificate for the domain. The page title returned by the HTTP 200 response is “Ledger Live – Secure and Manage Your Cryptocurrencies | Ledger Live,” and the brand target is listed as Google, classifying the activity as brand impersonation. The domain appears on one external blocklist and has been flagged by the PhishDestroy blocklist. On VirusTotal, nine of ninety‑four scanning engines reported malicious activity, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of abuse. Publicly available intelligence does not include a detailed content analysis beyond the page title, so the exact phishing payload or credential‑capture mechanisms remain unknown. Defenders should consider adding the domain to network‑level deny lists, enforce DNS filtering, and monitor for any outbound connections to the associated IP address. Continuous monitoring of Cloudflare‑associated domains and periodic re‑scanning of the URL are recommended to detect any changes in behavior.