us-ldgrres-lives[.]pages[.]dev

Analysis indicates that us-ldgrres-lives.pages.dev is an active phishing domain impersonating Ledger, a hardware wallet provider. The domain was registered on April 4, 2026, through Cloudflare, Inc., and remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to IP 172.66.47.129, hosted under Cloudflare’s network in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common pattern for both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The page title, 'Ledger Live Wallet — Technical Edition,' explicitly targets Ledger’s official software, Ledger Live. This aligns with the classified scam type of 'Brand Impersonation' and the identified phishing kit, 'Seed Phrase Phishing,' suggesting the site is designed to harvest cryptocurrency wallet recovery phrases. The domain appears on one security blocklist and is flagged by 3 of 94 security vendors on VirusTotal, though this detection rate is not conclusive evidence of malicious activity alone. Defenders should treat this domain as high-risk due to its active status, direct brand impersonation, and association with a known phishing kit. Recommended actions include blocking the domain at the network level, monitoring for related infrastructure (e.g., nameservers leland.ns.cloudflare.com and luciana.ns.cloudflare.com), and alerting users to avoid interaction. Further analysis of the site’s content or backend would be required to confirm specific attack vectors or additional indicators of compromise.