ledger---live--run[.]pages[.]dev

Analysis shows that ledger---live--run.pages.dev is an active brand‑impersonation site targeting Ledger. The domain was registered on 30 March 2026 and resolves to the Cloudflare IP 172.66.44.74, which is geolocated in Canada. DNS resolution uses the nameservers joselyn.ns.cloudflare.com and oswald.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 authority. HTTP requests return a 200 response and the page title "Ledger Live : L’application Wallet Crypto | Ledger - Guide complet" explicitly references the Ledger brand, confirming the impersonation intent. Infrastructure checks reveal HSTS enforcement, Cloudflare services, and HTTP/3 support. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis recorded eight detections out of ninety‑four scanners, and Gridinsoft assigns a trust score of 0 / 100, indicating strong malicious confidence. While the exact phishing payload or credential‑capture mechanisms have not been observed, the combination of brand‑specific page title, malicious detection count, and blocklist presence signals a high‑risk threat. Defenders should add the domain to URL filtering policies, monitor DNS queries for the associated IP and nameservers, and block traffic at the network perimeter. Continuous re‑scanning is advisable to capture any evolving malicious content.