live-us-ledgers[.]pages[.]dev

The domain live-us-ledgers.pages.dev was observed on July 12, 2026 delivering a high‑risk brand‑impersonation campaign targeting Ledger. The site presents a login interface titled “Ledger® Live: Login | Getting started™ with Ledger®”, mimicking the official Ledger Live portal. VirusTotal records indicate that 18 out of 95 security vendors have flagged the domain as malicious, and the page is currently listed on one active blocklist maintained by PhishDestroy. Infrastructure analysis shows the domain is hosted on Cloudflare’s network, resolving to IP address 172.66.44.237 located in Canada and served by the nameservers monroe.ns.cloudflare.com and tate.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. The domain was registered on March 22, 2026 through Cloudflare, Inc., and the Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. The page delivers a credential‑harvesting experience that solicits Ledger account credentials and may be used to facilitate cryptocurrency theft. The use of a Cloudflare‑protected sub‑domain (pages.dev) provides anonymity for the operators and enables rapid deployment of similar clones. The HTTP response code of 200 confirms that the content is actively served, and the presence of HSTS suggests an attempt to appear legitimate to unsuspecting users. Defenders should immediately block live-us-ledgers.pages.dev at DNS and proxy layers, and incorporate the associated IP address 172.66.44.237 into network‑level deny lists. Continuous monitoring of Cloudflare‑hosted sub‑domains for similar brand‑impersonation patterns is advised, as the infrastructure can be reused for future campaigns. Incident response teams should treat any credentials submitted to this site as compromised and advise affected users to reset authentication details and review wallet activity.