liv-e-ledger[.]pages[.]dev

The domain liv-e-ledger.pages.dev was registered on April 27, 2026 and is currently active. It resolves to IP address 188.114.97.3, which is owned by Cloudflare, Inc. and geolocated to Canada. The authoritative nameservers are harley.ns.cloudflare.com and sharon.ns.cloudflare.com, indicating that the domain leverages Cloudflare’s DNS and CDN services. An SSL certificate issued by Google Trust Services (WE1) is present, and the site serves HTTP 200 responses over HTTP/3 with HSTS enabled, suggesting a correctly configured TLS endpoint. The page title returned by the server is "Ledger Live | Securely Manage Your Crypto," directly referencing the Ledger brand and confirming a brand‑impersonation intent. VirusTotal reports that 13 of 91 security vendors have flagged the domain, and it is listed on at least one security blocklist, with PhishDestroy confirming active blocking. Detected technologies include Google Analytics, further indicating tracking capabilities. The overall risk assessment is high, and the campaign remains active. Uncertainty remains regarding the specific payload or credential‑capture mechanisms employed, as no page content beyond the title has been analyzed. Defenders should block the domain and associated IP address at network perimeters, monitor for similar subdomains hosted on Cloudflare, and educate end‑users to verify Ledger URLs against known official domains before entering any credentials. Continuous telemetry from security vendors should be reviewed for any changes in detection counts or new related indicators of compromise.