live-ldgerr[.]pages[.]dev

Analysis of the domain live-ldgerr.pages.dev reveals active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on April 24, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. Infrastructure analysis indicates the use of Cloudflare hosting, with detected technologies including Tailwind CSS, HSTS, and HTTP/3, alongside an SSL certificate issued by Google Trust Services. The page title, 'Ledger Live Integrations – Official Ledger Developer Portal,' explicitly aligns with Ledger’s branding, suggesting an intent to deceive users into believing the site is an official Ledger resource. The domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering, a classification consistent with phishing activity. Gridinsoft assigns a trust score of 0/100, further indicating high risk. While 95 security vendors have scanned the domain via VirusTotal, none currently detect malicious activity; however, the absence of detections does not confirm safety. The domain remains active as of July 12, 2026, and has been blocked by at least one security vendor specializing in phishing mitigation. Defenders should prioritize blocking or monitoring access to this domain, particularly in environments where Ledger-related services are used. The combination of brand impersonation, low trust scores, and social engineering flags warrants immediate action to prevent potential credential theft or financial fraud. Further investigation into the domain’s content and associated infrastructure is recommended to assess the full scope of the campaign.