liv-ledeger[.]pages[.]dev

On 25 July 2026 analysis of the domain liv-ledeger.pages.dev flagged it as an elevated‑risk site that masquerades as Ledger. The site’s only visible artifact is the page title “Ledger Live: The Ultimate Guide to Securely Track and Manage Your Cryptocurrency Portfolio”, which directly references Ledger’s branding and suggests a guide for crypto portfolio management. HTTP probing returned a 403 status, indicating that the server is refusing to serve the page content to the tester. The domain is registered through Cloudflare, Inc., uses Cloudflare’s nameservers (alla.ns.cloudflare.com and reese.ns.cloudflare.com), and resolves to the IP address 188.114.96.3 located in Canada within Cloudflare’s network.

TLS termination is provided by a Google Trust Services certificate issued under the “WE1” label, and the service enforces HSTS while supporting HTTP/3, confirming the use of modern Cloudflare infrastructure. VirusTotal scans show that three of ninety‑four security vendors flagged the domain, and the domain appears on one external blocklist, confirming that security‑focused feeds have identified it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the site. The domain was created on 23 March 2026, a relatively recent registration date consistent with fast‑moving phishing campaigns.

The site has been taken offline and is currently blocked by the PhishDestroy system, but the underlying infrastructure – Cloudflare’s network and the Google‑issued TLS certificate – remains usable for future re‑hosting attempts. Defenders should continue to block liv-ledeger.pages.dev at DNS and web‑filter layers, monitor the associated IP 188.114.96.3 for any re‑activation, and add the domain to internal threat intelligence feeds.