eng-ledgrelive[.]pages[.]dev

Analysis of eng-ledgrelive.pages.dev indicates an active phishing domain targeting users of the Ledger Live cryptocurrency wallet platform. The domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.46.247, a Cloudflare-hosted endpoint. As of July 29, 2026, six of 91 security vendors on VirusTotal have flagged the domain, and it appears on one security blocklist, specifically PhishDestroy. The domain uses Cloudflare nameservers kyrie.ns.cloudflare.com and tricia.ns.cloudflare.com, a common infrastructure choice for both legitimate and malicious sites.

The domain's structure and naming convention strongly suggest an intent to impersonate Ledger Live, a well-known cryptocurrency wallet interface. While the exact content of the site has not been analyzed, the presence on a phishing-specific blocklist and detections from multiple security vendors provide concrete evidence of malicious intent. The use of Cloudflare's infrastructure may complicate takedown efforts, as the registrar and hosting provider are the same entity, and Cloudflare is frequently used to mask the true origin of phishing sites. Defenders should treat this domain as high-risk for cryptocurrency-related fraud.

Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or with users likely to interact with Ledger Live. Monitoring for additional domains using similar naming patterns (e.g., 'ledgre', 'ledgerlive') under Cloudflare's pages.dev service may help identify related threats. While the domain is currently active, no additional details about the phishing kit, lure techniques, or specific wallet-draining mechanisms are available from the provided evidence. Further investigation into the site's content and backend infrastructure could reveal additional indicators of compromise.