ledzrlive-login[.]pages[.]dev

The domain ledzrlive-login.pages.dev was registered on April 30, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. The domain is served over HTTPS using a Google Trust Services / WE1 certificate and enforces HSTS. Cloudflare’s HTTP/3 and standard Cloudflare services are observed, and the authoritative nameservers are bonnie.ns.cloudflare.com and maxim.ns.cloudflare.com. The page title returned by the server is "Ledger® Live: Login | Getting Started™ — Step‑by‑Step Guide," indicating a direct attempt to mimic Ledger’s official branding. The site is classified as a credential‑phishing campaign targeting Ledger users, and it has been listed on at least one security blocklist. Independent analysis from Gridinsoft assigns a trust score of 0 out of 100, and the domain is actively blocked by PhishDestroy. No additional malware or payload analysis is available, and the content beyond the page title has not been publicly disclosed. Defenders should treat the domain as malicious, add the hostname to network‑level blocklists, enforce URL filtering for Cloudflare‑hosted subdomains, and monitor for any DNS resolution attempts to the IP address 188.114.97.3. User education campaigns should highlight the specific brand‑impersonation tactic used in the page title and advise against entering Ledger credentials on any non‑official Ledger domain. Continuous threat‑intel feeds should be consulted for updates, as the domain remains active and under investigation.