get-lives-en[.]pages[.]dev

The domain get-lives-en.pages.dev was registered on May 01, 2026 and remains active as of the July 12, 2026 report date. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc., using the nameservers arturo.ns.cloudflare.com and sureena.ns.cloudflare.com and resolving to the IP address 172.66.44.204 located in Canada. The site serves content over HTTPS with a Google Trust Services / WE1 certificate, enforces HSTS, and supports HTTP/3. A VirusTotal scan recorded 3 detections out of 91 security vendors, and the domain appears on a single public blocklist where it is listed by PhishDestroy. The page title observed is "Ledger® Live Wallet – Getting Started™ Developer Portal — Presentation," indicating a brand‑impersonation campaign targeting Ledger users. No additional page content has been publicly disclosed, leaving the exact phishing payload or credential‑capture mechanisms uncertain. Defenders should add get-lives-en.pages.dev to URL filtering and DNS block lists, monitor for any related C2 activity, and advise users to avoid any unsolicited links referencing Ledger Live that resolve to this domain. Continuous observation is recommended to detect any evolution of the threat infrastructure.