support-liveljore[.]pages[.]dev

The domain support-liveljore.pages.dev was registered on 2026-04-20 and is currently active. DNS resolution points to IP 172.66.45.6, hosted by Cloudflare, Inc. in Canada. The authoritative nameservers are aria.ns.cloudflare.com and lloyd.ns.cloudflare.com, indicating the domain is fully provisioned through Cloudflare’s infrastructure. The site serves content over HTTPS with a Google Trust Services / WE1 certificate and enforces HSTS, while also supporting HTTP/3. The observed HTTP response code is 200, and the page title returned is "Ledger Live Login — Secure Access to Your Crypto Wallet®," confirming a direct impersonation of Ledger’s brand. The threat is classified as credential phishing, targeting users who may attempt to log into Ledger Live. Security telemetry shows a Gridinsoft trust score of 0/100 and 13 of 94 VirusTotal scanners flag the domain as malicious. It is already listed on one security blocklist and has been blocked by PhishDestroy. While the page content beyond the title has not been publicly analyzed, the combination of brand‑specific title, Cloudflare‑based hosting, and low trust scores strongly indicates a high‑risk phishing operation. Defenders should immediately add support-liveljore.pages.dev to URL filtering policies, monitor for any inbound connections to the associated IP, and consider network‑level blocking or sinkholing. User education campaigns should reinforce that Ledger will never request credentials via a third‑party domain, and any login attempt to a URL containing "support‑liveljore.pages.dev" should be treated as malicious.