ledgrlive-auth[.]pages[.]dev

Analysis of ledgrlive-auth.pages.dev shows a newly registered domain (created 23 Mar 2026) that is actively impersonating the Ledger brand. The domain resolves to the Cloudflare‑owned address 172.66.47.110, which is geolocated to Canada. Cloudflare name servers (bristol.ns.cloudflare.com, ricardo.ns.cloudflare.com) and the presence of HSTS and HTTP/3 confirm that the site is hosted behind Cloudflare’s edge network. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate‑looking HTTPS endpoint. When accessed, the server returns HTTP 403, suggesting the content is either restricted or has been taken down; the current status is reported as offline.

Multiple security vendors have flagged the domain: 9 of 94 scanners on VirusTotal raise detections, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one external blocklist and has been added to PhishDestroy’s blacklist, reinforcing its malicious classification. The page title, “Ledger Live: | Secure Your Crypto Device® | Ledger”, directly references Ledger’s product line, aligning with the reported “Crypto Scam” taxonomy. The evidence confirms a brand‑impersonation campaign targeting Ledger users, likely intended to harvest cryptocurrency credentials.

However, the exact payload, phishing form, or malicious redirects have not been publicly disclosed, and the site’s content cannot be inspected due to the 403 response. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint layers, monitor for additional subdomains under the same registrar or Cloudflare account, and enforce strict TLS inspection to detect any future content changes. Continuous re‑scanning of the domain on multi‑engine platforms is advised to capture evolving detections. Given the low trust score and active blocklist entries, the domain should be treated as high‑confidence malicious.