live-ledgrr-app-en[.]pages[.]dev

Analysis of live-ledgrr-app-en.pages.dev indicates a recently registered domain (created 24 March 2026) that was used to impersonate Ledger’s official “Ledger Live” application. The site resolved to the Cloudflare edge IP 172.66.46.246, which is associated with Cloudflare, Inc. in Canada. DNS resolution used the Cloudflare‑provided authoritative nameservers ariella.ns.cloudflare.com and damon.ns.cloudflare.com, confirming that the registrar is also Cloudflare, Inc. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, a legitimate certificate chain that does not, by itself, indicate malicious intent but is commonly leveraged by threat actors to gain user trust. The HTTP response returned a 403 status code, suggesting that the page is no longer publicly accessible; the current status is listed as offline. When the page was reachable, the title displayed “Ledger Live – Secure Crypto Management App,” directly referencing the Ledger brand.

The domain is classified as a crypto‑related scam and was flagged for brand impersonation of Ledger. VirusTotal recorded 13 positive detections out of 94 scanned engines, and the domain appears on at least one public blocklist. Additional security‑rating services, such as Gridinsoft, assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The site employed modern security technologies including HSTS and HTTP/3, both provided by Cloudflare, which can obscure traffic analysis but do not mitigate the underlying phishing intent.

Defenders should add the domain and its resolved IP address to network‑level blocklists and ensure that any endpoint protection solutions reference the current VirusTotal detection count. Continuous monitoring of Cloudflare‑registered subdomains that mimic Ledger branding is advised, as the infrastructure can be rapidly regenerated.