ledge-live-login-info[.]pages[.]dev

The domain ledge-live-login-info.pages.dev is currently active and returns HTTP 200 with the page title “Ledger® Live Login | Protect”. It was registered on March 23 2026 through Cloudflare, Inc., uses Cloudflare nameservers (georgia.ns.cloudflare.com and rustam.ns.cloudflare.com) and resolves to the IP address 188.114.96.3, which is associated with Cloudflare’s network in Canada. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS configuration. Infrastructure analysis shows the site employs HSTS, HTTP/3 and Cloudflare’s edge services, which are typical for fast‑content delivery but do not mitigate the malicious intent. Reputation data assigns a Gridinsoft trust score of 0 / 100 and classifies the operation as a crypto‑related brand‑impersonation scam targeting Ledger users. The domain appears on one public blocklist and has been flagged by PhishDestroy. VirusTotal reports that 14 of 94 security vendors have identified the host as malicious, reinforcing the risk assessment. The combination of a brand‑impersonation page title, low trust score, blocklist presence, and multiple vendor detections supports a high‑risk rating. Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because the page content has not been examined. Defenders should block network connections to 188.114.96.3 and to the domain name, add the host to internal URL filtering lists, and monitor for any outbound traffic that may indicate successful credential capture. Continuous re‑scanning of the domain on multi‑engine services is advised to capture any changes in detection status.