connect-ladgre-live[.]pages[.]dev

The domain connect‑ladgre‑live.pages.dev was observed on July 12 2026 delivering a high‑risk brand‑impersonation campaign targeting Ledger users. The site presents a login page titled “Ledger Live Login Secure Access” and is classified as credential phishing. The domain was created on May 01 2026 and remains active, with an HTTP 200 response indicating a live service. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which belongs to Cloudflare’s network in Canada. Authoritative nameservers chad.ns.cloudflare.com and coco.ns.cloudflare.com confirm the use of Cloudflare’s DNS platform. The TLS certificate is issued by Google Trust Services under the WE1 identifier, providing a valid HTTPS endpoint. Threat intelligence flags the site on a single blocklist, PhishDestroy, and a VirusTotal scan recorded one positive detection out of ninety‑five scanners. The Gridinsoft trust score of zero further indicates a malicious reputation. The page title and branding explicitly mimic Ledger’s official “Ledger Live” interface, suggesting an attempt to harvest user credentials. Current evidence does not reveal the backend storage location for harvested credentials, nor any observed exfiltration activity. The limited detection count may reflect recent deployment, but the combination of brand impersonation, high‑risk rating, and active hosting warrants heightened vigilance. Defenders should immediately block the domain and its associated IP address at network perimeter devices, update URL filtering rules to include the full domain, and monitor for similar sub‑domains under the pages.dev hosting service. Continuous telemetry collection on credential‑phishing attempts against Ledger users is recommended to capture emerging variants.