learn-ldgr-lives-avz[.]pages[.]dev

Analysis of the domain learn-ldgr-lives-avz.pages.dev indicates an active phishing campaign targeting Ledger hardware wallet users. The domain, registered on April 5, 2026, through Cloudflare, Inc., currently resolves to IP address 188.114.97.3. The page title, 'Ledger® Live — Login & Getting Started (Presentation),' directly impersonates the official Ledger Live interface, suggesting an intent to harvest seed phrases or login credentials. Infrastructure analysis reveals the use of Cloudflare hosting and a Google Trust Services SSL certificate, which may contribute to the site's apparent legitimacy to unsuspecting users. Detection data as of July 12, 2026, shows the domain is flagged by 10 of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 further supports the classification of this domain as malicious. The presence of a 'Seed Phrase Phishing' kit aligns with common tactics used to compromise cryptocurrency wallets by tricking users into entering recovery phrases. While the domain remains active, defenders should prioritize blocking access to 188.114.97.3 and the domain itself at the network level. Organizations and individuals using Ledger devices should be alerted to verify URLs carefully before entering sensitive information. Additional monitoring of newly registered domains under Cloudflare's pages.dev service may help identify similar threats. The exact content and functionality of the phishing page have not yet been analyzed, but the available indicators strongly suggest a high-risk credential harvesting operation.