en-live-ledgr[.]pages[.]dev

Analysis indicates that en-live-ledgr.pages.dev is an active phishing infrastructure targeting Ledger customers. The domain was registered on 21 February 2026 and is hosted on Cloudflare's network, resolving to IP 172.66.45.36 which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. HTTP response code 403 suggests the site is presently inaccessible, and the domain has been taken offline, yet historical evidence remains relevant for threat hunting. The page title returned by the server reads “Ledger Live | Secure Crypto Wallet & Portfolio Manager,” directly mirroring the official Ledger Live branding.

Intelligence tags the activity as Wallet/Seed Phishing and notes that the domain impersonates the Ledger brand. VirusTotal recorded a single positive detection out of 93 scanners, and the domain is listed on one external blocklist. PhishDestroy also flagged the site, and Gridinsoft assigned a trust score of 0 / 100, indicating extreme malicious confidence. Nameservers are novalee.ns.cloudflare.com and jose.ns.cloudflare.com, both Cloudflare‑managed. The domain’s registration through Cloudflare, Inc. without a traditional registrar obscures owner attribution, further complicating takedown efforts.

Infrastructure analysis shows HSTS enforcement and HTTP/3 support, typical for Cloudflare‑protected sites and useful for attacker reliability. No additional public observables such as URL paths or form fields are available, so the exact phishing payload remains unknown. Defenders should update URL filtering and domain blocklists to include en-live-ledgr.pages.dev, monitor for any future resolution changes, and correlate network traffic to the associated Cloudflare IP range.