connect-ledger-livee-app[.]pages[.]dev

The domain connect-ledger-livee-app.pages.dev is flagged as a high‑risk, active brand‑impersonation site targeting Ledger. Registration records show the domain was created on March 26, 2026 and is managed through a prominent CDN provider, with authoritative nameservers betty.ns.cloudflare.com and yoxall.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which is located in Canada and attributed to the same CDN infrastructure. The site serves content over HTTPS; the presented certificate is issued by Google Trust Services (WE1) and the server advertises HSTS and HTTP/3 support, returning HTTP 200 for the landing page titled “Ledger Live App – Download”. Threat intelligence indicates the domain appears on a single security blocklist and has been blocked by an anti‑phishing service. VirusTotal scans show two of ninety‑four scanners flagged the domain, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. While the page title confirms the intent to impersonate the Ledger brand, the full page content has not been publicly analysed, leaving the exact credential‑harvesting mechanisms uncertain. Defenders should add the domain and its resolving IP to outbound blocklists, monitor for similar sub‑domains registered after March 2026, and enforce TLS inspection to detect any hidden payloads. Continuous re‑scanning with multi‑engine services is recommended to capture any evolving indicators.