gets-ledgrlive[.]pages[.]dev

The domain gets-ledgrlive.pages.dev was registered on May 17, 2026 through Cloudflare Pages and resolves to the Cloudflare IP address 172.66.44.99 located in Canada. The site serves content over HTTPS using a Google Trust Services / WE1 certificate and returns HTTP 200 for requests. The page title observed is “Ledger® Live Wallet – Getting Started™ Developer Portal,” indicating a clear attempt to mimic Ledger’s official branding. Threat intelligence classifies the activity as a high‑risk brand impersonation targeting the Ledger brand. VirusTotal scans show that 7 of 92 security vendors flag the domain, and the Gridinsoft trust score is 0 / 100, reinforcing malicious intent. The domain is already blocked by the PhishDestroy service and appears on one public blocklist, confirming that defensive feeds are aware of its presence. Current evidence is limited to registration metadata, SSL details, and the page title; no deeper content analysis has been performed, so the exact malicious payload or credential‑capture mechanisms remain unknown. Defenders should immediately block the domain at DNS and proxy layers, add the IP address to threat‑intel feeds, and monitor for any outbound connections to Cloudflare edge nodes that match the observed address. Continuous scanning of the URL for new content and periodic re‑verification of the blocklist status are recommended to ensure rapid detection of any evolution in the campaign.