sso-livee-en-ledgr[.]pages[.]dev

The domain sso-livee-en-ledgr.pages.dev, created on April 02, 2026, is currently active and serves a page titled "Ledger Live® | Advanced Crypto Management & Swaps™," indicating a direct impersonation of the Ledger brand. The site resolves to IP address 172.66.47.200, which is hosted by Cloudflare, Inc. in Canada and uses a Google Trust Services / WE1 SSL certificate. HTTP requests return a 200 status code, and the domain is listed on a single security blocklist while being blocked by PhishDestroy. VirusTotal scans show three of ninety-four security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk classification. The nameservers doug.ns.cloudflare.com and opal.ns.cloudflare.com confirm the use of Cloudflare's DNS infrastructure. No additional technical details about the page content, credential harvesting mechanisms, or malicious payloads have been disclosed, leaving the exact operational tactics uncertain. Defenders should immediately block or sinkhole sso-livee-en-ledgr.pages.dev at the network perimeter, monitor DNS queries for the associated IP and nameservers, and educate end users that any Ledger‑related login prompts originating from this domain are malicious. Ongoing intelligence collection should focus on any observed traffic patterns, potential command‑and‑control activity, and updates to threat feeds that may reveal further infrastructure linked to this impersonation campaign.