help-ledgerr-live[.]pages[.]dev

The domain help-ledgerr-live.pages.dev is currently active and classified as a high‑risk brand impersonation campaign targeting Ledger. The site resolves to IP address 172.66.44.146, a Cloudflare‑owned host located in Canada, and is served over HTTPS using a Google Trust Services certificate issued by the WE1 authority. Technical analysis shows the presence of HSTS, Cloudflare services, and HTTP/3 support. The domain was registered on April 25, 2026 through Cloudflare, Inc., and utilizes the authoritative nameservers izabella.ns.cloudflare.com and jeff.ns.cloudflare.com. The page title mirrors official Ledger wording, reading "Ledger Live App – Download, Setup & Secure Crypto | Official Ledger Website," which aligns with the declared brand target. VirusTotal scans indicate that 13 of 94 security vendors flag the domain as malicious, and it appears on one external blocklist, specifically PhishDestroy. Independent scoring by Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. HTTP requests return a 200 status, confirming that the site is actively delivering content. Defenders should prioritize blocking the domain and its associated IP address at network perimeters, update intrusion detection signatures to include the observed nameservers and certificate details, and monitor for any related activity leveraging the same Cloudflare infrastructure. Continuous observation is advised, as the campaign remains active and may evolve its payload or hosting configuration.