io-ledge-lives[.]pages[.]dev

The domain io-ledge-lives.pages.dev is currently active and hosts a page titled “Ledger Live* | Secure Crypto Wallet & Portfolio* Manager,” indicating a direct attempt to impersonate the Ledger brand. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, and the HTTP response code is 200, confirming that the page is reachable. Infrastructure analysis shows the domain was registered on April 06, 2026 and is hosted on Cloudflare’s network, resolving to IP address 172.66.47.112 located in Canada. Nameserver records point to kristin.ns.cloudflare.com and trace.ns.cloudflare.com, confirming Cloudflare as the DNS provider. Security monitoring has flagged the domain on one blocklist, and PhishDestroy has already blocked it. VirusTotal scans report three detections out of ninety‑four vendors, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the page content beyond the title has not been publicly dissected, the combination of brand‑specific terminology, recent domain creation, and low trust scores strongly suggests a credential‑harvesting campaign targeting Ledger users. Defenders should add the domain to internal blocklists, monitor DNS queries for outbound connections to 172.66.47.112, and enforce email and web filtering rules that detect the Ledger brand in URLs or page titles. Incident response teams should also advise users to verify the authenticity of any Ledger‑related communications and to avoid entering credentials on unverified sites. The limited detection history indicates the campaign is in early stages; continued observation of related indicators of compromise is recommended.