leddgerlive[.]pages[.]dev

Analysis of the domain leddgerlive.pages.dev shows a newly registered infrastructure that targets the Ledger brand. The domain was created on April 09, 2026 and is hosted behind Cloudflare, Inc., resolving to the IP address 172.66.44.174, which is geolocated to Canada and associated with Cloudflare’s network. The site presents the page title "Ledger Live| Getting started," indicating a direct brand impersonation attempt. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming that the connection is encrypted but does not attest to the legitimacy of the content.

HTTP responses return a status code 200, suggesting the page is actively serving content. Registration details list Cloudflare, Inc. as the registrar, and the authoritative nameservers are randy.ns.cloudflare.com and suzanne.ns.cloudflare.com. VirusTotal scans have recorded six positive detections out of ninety‑four security vendors, and the domain appears on one external blocklist, with PhishDestroy already listing it as blocked. A Gridinsoft trust score of zero out of one hundred further underscores the malicious nature of the host.

The threat is classified as a brand impersonation campaign targeting Ledger users, and the current status is active. Uncertainty remains regarding the specific payload or credential‑capture mechanisms employed, as no detailed page content has been disclosed. Defenders should block DNS resolution for leddgerlive.pages.dev, monitor outbound connections to the IP 172.66.44.174, and enforce URL filtering policies that flag the observed page title. Incident response teams should also consider notifying affected Ledger users and updating security intelligence feeds with the observed indicators of compromise.