live-ladar-app[.]pages[.]dev

The domain live-ladar-app.pages.dev was registered on April 11, 2026 through Cloudflare, Inc. and is currently resolved to the IP address 172.66.47.132, which is geolocated in Canada and attributed to Cloudflare infrastructure. The site presents a valid SSL certificate issued by Google Trust Services (WE1) and serves content over HTTPS with HSTS and HTTP/3 enabled. An HTTP request returns a 200 status code and the page title is "Ledger Live App® | Official Ledger Mobile & Desktop Application," directly targeting the Ledger brand. VirusTotal analysis shows that 9 of 94 security vendors flagged the domain, and the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. The domain is listed on one public security blocklist and has been blocked by the PhishDestroy service. Current status is active, and no additional technical artifacts such as payloads or command‑and‑control endpoints have been observed in the available intelligence. Uncertainty remains regarding the exact malicious behavior (e.g., credential harvesting, malware delivery) because the page content beyond the title has not been examined. Defenders should prioritize immediate mitigation by adding live-ladar-app.pages.dev to DNS and URL filtering rules, monitoring outbound connections to its resolved IP, and alerting users about the ongoing Ledger brand impersonation campaign. Continuous observation for any changes in hosting, certificate details, or detection rates is advised.