ldgr-live-sso[.]pages[.]dev

Analysis of the domain ldgr-live-sso.pages.dev indicates a high-risk brand impersonation campaign targeting Ledger, the cryptocurrency hardware wallet provider. The domain was registered on March 24, 2026, through Cloudflare, Inc. and is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.96.3 (CA). The site was flagged by 14 of 94 security vendors on VirusTotal, and it appears on at least one security blocklist (PhishDestroy). Google Safe Browsing classified this domain as engaging in social engineering, while Gridinsoft assigned a trust score of 0/100.

The page title, 'Ledger Live | Secure Crypto Management Platform,' directly aligns with Ledger’s branding, reinforcing the impersonation threat. Infrastructure analysis reveals the use of Cloudflare nameservers (grant.ns.cloudflare.com and paislee.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The domain employs HSTS and HTTP/3, which are common for legitimate sites but also adopted by threat actors to evade detection. As of July 23, 2026, the domain returns an HTTP 403 status, suggesting it has been taken offline, though residual DNS records may persist.

The exact content and functionality of the site remain unconfirmed, as no forensic capture is available. Defenders should treat this domain as compromised and block it at the DNS and network levels. Given the use of Cloudflare Pages, monitoring for similar subdomains under *.pages.dev is recommended. The combination of brand impersonation, low trust scores, and security vendor detections justifies a high-risk classification, despite the current offline status.