ldgres-io-lives[.]pages[.]dev

This domain, ldgres-io-lives.pages.dev, is actively flagged as a high-risk phishing site impersonating Ledger, a hardware wallet provider. Infrastructure analysis reveals the domain was registered on April 4, 2026, and is currently resolving to IP address 172.66.47.101, hosted behind Cloudflare infrastructure in Canada. The domain is served by Cloudflare nameservers (leland.ns.cloudflare.com and luciana.ns.cloudflare.com) and presents an SSL certificate issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is commonly leveraged by threat actors to lend legitimacy to phishing pages. The page title, 'Ledger Live Wallet — Technical Edition,' explicitly targets Ledger users, suggesting an attempt to deceive victims into interacting with a fraudulent wallet interface. Known intelligence classifies this as a 'Seed Phrase Phishing' campaign, a tactic designed to harvest cryptocurrency wallet recovery phrases. The domain appears on at least one security blocklist, and three of 94 security vendors on VirusTotal have flagged it as malicious, though this detection rate is not conclusive evidence of widespread recognition. The site remains operational, returning an HTTP 200 status, and has not been taken down as of July 12, 2026. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Ledger-related services are used. Given the use of Cloudflare hosting, traditional takedown requests may be less effective, and monitoring for related subdomains or IP shifts is recommended. The presence of a phishing kit indicates automated deployment, increasing the likelihood of additional malicious domains using similar naming conventions or infrastructure. No further details about the exact content or functionality of the phishing page are available at this time, but the combination of brand impersonation, seed phrase targeting, and active status warrants immediate mitigation.