ledglive[.]m-pages[.]com

Analysis indicates that ledglive.m-pages.com is an active credential‑stealing site targeting Ledger customers. The domain was registered on 2026‑02‑21 via MarkMonitor and resolves to the Amazon‑owned address 3.66.78.109 located in Germany (AS16509). SSL is provided by a Sectigo Limited certificate issued for a public server authentication CA. HTTP requests receive a 302 redirect, and the site has been listed on at least one security blocklist and flagged by PhishDestroy. VirusTotal records show three of ninety‑three scanners flagging the domain as malicious. The page title returned by the server explicitly references “Ledger® Live: Download | Getting started™ Ledger®”, confirming a direct brand impersonation attempt. Infrastructure fingerprints reveal the use of Amazon Elastic Load Balancing and generic AWS hosting, a common pattern for rapidly deployed phishing kits. The Gridinsoft trust score of 0/100 further supports a low‑reputation classification. No additional technical artifacts (e.g., malicious payloads, credential‑capture forms) have been disclosed, so the exact content and behavior of the landing page remain unverified. Defenders should immediately block DNS resolution and HTTP(S) traffic to the domain, add the IP address 3.66.78.109 to network‑level deny lists, and monitor for any newly registered domains that reuse the “ledg” prefix or similar AWS name‑server patterns. Continuous threat‑intel feeds should be consulted for updates, and any internal alerts involving Ledger credentials should be investigated for possible compromise linked to this infrastructure.