learn-lddgr-live[.]pages[.]dev

Analysis indicates that the domain learn-lddgr-live.pages.dev is actively impersonating Ledger, a hardware cryptocurrency wallet provider, as part of a high-risk brand impersonation campaign. The domain was registered on April 5, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.132. Infrastructure analysis reveals the use of Cloudflare Pages hosting, with an SSL certificate issued by Google Trust Services, a common configuration for both legitimate and malicious sites. The page title, 'Ledger® Live — Login & Getting Started (Presentation),' explicitly mimics the official Ledger Live application, suggesting an intent to deceive users into entering sensitive credentials or recovery phrases. The domain is associated with a seed phrase phishing kit, a toolset frequently employed to harvest cryptocurrency wallet recovery phrases. As of July 12, 2026, the domain is flagged by 8 of 95 security vendors on VirusTotal and appears on at least one security blocklist. Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious classification. The domain remains active, with no evidence of takedown or remediation. Defenders should treat this domain as a confirmed threat vector targeting Ledger users. Network-level blocking of 172.66.47.132 and the domain itself is recommended. Given the use of Cloudflare infrastructure, additional scrutiny of subdomains under pages.dev may be warranted to identify related malicious activity. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, seed phrase phishing kit association, and detection by multiple security vendors justifies immediate mitigation actions.