new-ledgr-live[.]pages[.]dev

Analysis of the domain new-ledgr-live.pages.dev indicates active phishing infrastructure targeting users of the Ledger cryptocurrency hardware wallet brand. The domain was registered on August 18, 2025, through Cloudflare Pages, a platform frequently abused for rapid deployment of phishing pages due to its free hosting and automatic SSL certificates. Infrastructure analysis reveals the domain resolves to the IP address 172.66.44.91, which is part of Cloudflare’s network, a common characteristic of phishing campaigns leveraging CDN services to obscure origin servers and evade IP-based blocking. As of July 29, 2026, the domain is flagged by 16 of 91 security vendors on VirusTotal, a detection rate consistent with known phishing pages.

Google Safe Browsing has classified the site as engaging in social engineering, a designation typically applied to pages designed to deceive users into divulging sensitive information. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, further corroborating its malicious classification. The registrar, Cloudflare Pages, does not provide traditional WHOIS details, limiting visibility into the registrant’s identity. However, the use of a subdomain under pages.dev, combined with the domain name incorporating 'ledgr' (a clear reference to Ledger), strongly suggests an intent to impersonate the official Ledger platform.

No specific phishing kit or additional brand indicators have been confirmed in the available data, and the exact content of the page remains unanalyzed. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Organizations using Ledger products are advised to alert users and monitor for credential submissions or wallet-draining activity associated with this infrastructure.