ligjre-livelogiin[.]pages[.]dev

The domain ligjre-livelogiin.pages.dev is currently active and classified as a brand‑impersonation threat targeting Ledger. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which is owned by Cloudflare, Inc. and located in Canada. Registration details indicate the domain was created on 2026‑04‑04 and is served through Cloudflare’s DNS infrastructure (alexis.ns.cloudflare.com, kay.ns.cloudflare.com). The site presents an HTTPS certificate issued by Google Trust Services under the WE1 identifier, confirming TLS termination at the CDN edge. HTTP probing returns a 200 status code, and the page title disclosed by the source is "Ledger Live Wallet | Manage Your Crypto Securely," directly referencing the Ledger brand. VirusTotal analysis records six positive detections out of ninety‑four scanning engines, and the Gridinsoft trust score is 0 / 100, reflecting a highly suspicious rating. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. While the observed metadata confirms the presence of brand‑impersonation infrastructure, the actual content of the page beyond the title has not been publicly examined, leaving the full scope of credential‑harvesting or malicious payload delivery uncertain. Defenders should immediately add the domain to network deny lists, enforce DNS‑based blocking, and monitor for any related C2 traffic originating from the associated Cloudflare IP. Continuous re‑evaluation is advised, given the low trust score and multiple vendor detections, to ensure rapid response if the campaign evolves or expands its infrastructure.