apps-ladger-live[.]pages[.]dev

This domain, apps-ladger-live.pages.dev, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as indicated by its page title ('Building a Live App: Step-by-Step Tutorial - Ledger') and confirmed brand target data. Registered on May 6, 2026, through Cloudflare, Inc., the domain resolves to IP address 172.66.47.170, hosted on Cloudflare infrastructure in Canada. Analysis reveals the use of Cloudflare nameservers (imani.ns.cloudflare.com, marty.ns.cloudflare.com) and technologies including HSTS and HTTP/3, which are consistent with legitimate services but frequently exploited by threat actors to lend credibility to phishing sites. Security vendors have flagged this domain, with 7 of 91 detections on VirusTotal, though the specific nature of these detections remains unverified. The domain is currently active, returning an HTTP 200 status, and has been blocked by at least one security blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, further indicating high risk. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as valid certificates are commonly used in phishing campaigns to evade browser warnings. While the exact content and functionality of the site are not yet analyzed, the combination of brand impersonation, active status, and security vendor detections strongly suggests malicious intent. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring access to it. Further investigation is recommended to determine if the site employs credential harvesting, malware distribution, or other attack vectors. Given the targeting of Ledger users, organizations handling cryptocurrency or sensitive financial data should assess exposure and implement protective measures.