legerlivehelp[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Registered on April 30, 2026, through Cloudflare, Inc., the domain resolves to IP 172.66.47.160 hosted on Cloudflare infrastructure in Canada. The page title, 'Ledger Live Wallet — Manage Crypto Securely', closely mimics an official Ledger support or wallet interface, consistent with credential harvesting or crypto asset theft. The domain uses SSL certificates from Google Trust Services, employs HSTS and HTTP/3, and is hosted on Cloudflare Pages (indicated by the pages.dev subdomain). Threat intelligence shows broad detection: 7 of 91 antivirus vendors on VirusTotal flag the domain, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, reflecting a complete lack of legitimacy. Notably, the domain was created only two and a half months ago, a common pattern for phishing infrastructure that is rapidly deployed and abandoned. The exact page content beyond the title has not been retrieved or analyzed, but the combination of recent registration, Cloudflare hosting, a branded title, and widespread vendor detection confirms malicious intent. Defenders should block access to this domain across all network perimeters, monitor for related subdomains or variations, and review logs for any devices that may have visited the site. Users should be warned not to enter any credentials or recovery phrases on this domain.