liv-live-ledger[.]pages[.]dev

Analysis of liv-live-ledger.pages.dev indicates an active brand impersonation campaign targeting Ledger users. The domain was registered on March 28, 2026 through Cloudflare, Inc., and its authoritative name servers are porter.ns.cloudflare.com and rosalyn.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to IP address 188.114.97.3, a Cloudflare edge node commonly used for content delivery and proxy services, which complicates attribution of the underlying host. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, confirming that at least one anti‑phishing service has identified it as malicious.

VirusTotal scans show that 9 of 91 security vendors flagged the domain, providing independent corroboration of suspicious activity. No public evidence of SSL certificate details, HTTP response codes, or page title information is currently available, limiting visibility into the exact payload or landing page behavior. The limited detection footprint—one blocklist listing and modest vendor flag count—suggests the campaign may be in early deployment or using low‑volume distribution channels.

Defenders should prioritize adding liv-live-ledger.pages.dev to domain blocklists across perimeter and endpoint filters, monitor DNS queries for the associated Cloudflare name servers, and enforce strict email authentication for any Ledger‑related communications to reduce successful credential harvest attempts. Continuous re‑assessment is advised, as additional detection signals such as expanded blocklist listings, increased vendor flags, or observed malicious payloads would elevate the threat posture. Until further forensic evidence emerges, the elevated risk rating remains justified based on the confirmed impersonation intent, active registration, and existing detection signals.