ledgerlivapp-new[.]pages[.]dev

The domain ledgerlivapp-new.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently hosted on the provider’s edge network (IPv6 address 2606:4700:310c::ac42:2cd1, AS13335, United States). The site presents a page titled “Ledger Live App | Secure Crypto Management App”, directly mimicking the legitimate Ledger Live brand. Analysis classifies the activity as a seed‑phishing impersonation of the Across brand, and the domain is listed as active by threat intel sources.

Infrastructure inspection shows the service enforces HTTP Strict Transport Security and negotiates HTTP/3, confirming the presence of modern TLS configurations. The SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint. Nameservers lilyana.ns.cloudflare.com and pranab.ns.cloudflare.com resolve to the registrar’s authoritative DNS, reinforcing the use of managed DNS and edge hosting.

Reputation signals are strongly negative: VirusTotal records seven out of ninety‑five scanners flagging the domain, Scamadviser assigns a trust score of 41 out of 100, and Gridinsoft reports a score of zero. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy. The HTTP response code is 200, confirming that the page is served without redirection, and the page title aligns with the targeted brand, providing a credible lure for unsuspecting users.

Uncertainty remains regarding the exact phishing kit or credential harvesting endpoint, as no payload URLs or form actions have been disclosed. Defenders should add the IPv6 address and the fully qualified domain to network blocklists, enforce DNS filtering for the “pages.dev” subdomain, and monitor edge‑originated traffic for anomalous request patterns. Users should be educated to verify TLS certificates and to avoid entering credentials on any site that does not match the official Ledger Live domain.