ledgrlive-en-help[.]pages[.]dev

The domain ledgrlive-en-help.pages.dev was registered on April 27, 2026 and is currently active. It resolves to the IP address 188.114.96.3, which is hosted in Canada and appears to be served through a CDN provider that enforces HSTS and supports HTTP/3. The site presents the page title "Ledger Login – Secure Access with Ledger," indicating a credential‑phishing campaign that impersonates the Ledger brand. VirusTotal scans show that 11 of 91 security vendors flagged the domain, and the domain is listed on a known phishing blocklist (PhishDestroy) as well as one additional blocklist. The SSL certificate is issued by a public certificate authority, but the low trust score of 0/100 from a reputable reputation engine further confirms malicious intent. Infrastructure analysis reveals the domain is registered through a registrar that offers DNS services, using the nameservers houston.ns.cloudflare.com and nia.ns.cloudflare.com. Defenders should immediately block the domain at the perimeter, add it to URL filtering policies, and monitor for any DNS queries to the associated IP. Users should be reminded not to enter Ledger credentials on any site that does not belong to the official Ledger domain, and any attempted credential submissions to this domain should be logged and investigated.