first-ledger-live-login-eng-us[.]pages[.]dev

This domain, first-ledger-live-login-eng-us.pages.dev, is under investigation for brand impersonation targeting Ledger, a hardware wallet provider. Registered on September 17, 2025, through Cloudflare, Inc., the domain currently resolves to IP 172.66.47.177 and is flagged on one security blocklist (PhishDestroy). The page title, 'Ledger® Live: Login | Getting started™ with Ledger®,' explicitly mimics Ledger’s official branding, suggesting an intent to deceive users into entering credentials or sensitive information. Infrastructure analysis reveals the use of Cloudflare hosting, HSTS, and HTTP/3, which are common in both legitimate and malicious sites. The SSL certificate is issued by Google Trust Services, a standard provider, and no detections were reported by the 95 vendors that scanned the domain on VirusTotal. However, the absence of detections does not confirm safety, as phishing domains often evade initial scans. The domain remains active as of July 12, 2026, with no additional indicators of compromise or malicious activity beyond the impersonation context. Defenders should treat this domain as high-risk due to its brand-targeting nature and consider blocking or monitoring it pending further analysis. No evidence of credential harvesting, malware distribution, or other payload delivery has been confirmed at this stage, but the domain’s structure and branding align with known phishing tactics.