app-lives-ledgr[.]pages[.]dev

The domain app-lives-ledgr.pages.dev was registered on April 30, 2026 and is presently resolving to the Cloudflare‑owned address 188.114.97.3, hosted in Canada. DNS records show the domain is served by the Cloudflare nameservers chelsea.ns.cloudflare.com and jaxson.ns.cloudflare.com, and the site is protected by a Google Trust Services / WE1 SSL certificate, indicating the use of standard Cloudflare TLS termination. An HTTP GET returns a 200 response and the page title "GLedger Live Integrations – Ledger Developer Portal" directly references the Ledger brand, confirming the classification as a brand‑impersonation campaign. The infrastructure stack reports HSTS, HTTP/3, and Cloudflare as the underlying technology, and the domain appears on a single security blocklist, with PhishDestroy already flagging it as malicious. No public malware detections have been reported, but the absence of detections does not constitute assurance of safety. The current status is active, and threat investigators have not disclosed the content of the landing page beyond the title, leaving the exact payload or credential‑harvesting mechanism uncertain. Defenders should block network resolution to 188.114.97.3, monitor for any outbound connections to the domain, and update email filtering rules to quarantine messages that reference Ledger‑related URLs pointing to this subdomain. Continuous observation is advised to capture any changes in the site’s content or additional infrastructure components that may be introduced.