us-ledgerr-live[.]pages[.]dev

The domain us-ledgerr-live.pages.dev is currently active and resolves to the IPv4 address 172.66.44.55, which is geolocated to Canada and associated with a large DNS and CDN provider. The site serves HTTP 200 responses and presents an SSL certificate issued by Google Trust Services under the WE1 authority, indicating a valid TLS configuration. Page metadata returns the title “Ledger® Live: Login — Getting Started™”, and the domain is classified as a crypto‑related brand‑impersonation campaign targeting Ledger users. VirusTotal analysis shows 13 of 94 security vendors flag the host, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The domain is listed on one external blocklist and has been blocked by the PhishDestroy sinkhole. Infrastructure fingerprints include HSTS enforcement, HTTP/3 support, and the use of the nameservers casey.ns.cloudflare.com and molly.ns.cloudflare.com, confirming registration through a widely used DNS service. The domain was created on 23 March 2026, indicating recent deployment. While the exact phishing page content has not been inspected, the combination of a Ledger‑related title, crypto scam classification, and multiple vendor detections suggests credential harvesting or token theft. Defenders should add the domain and its IP address to deny‑list rules, monitor DNS queries for the associated nameservers, and ensure that any Ledger credential entry points are blocked at the network perimeter. Ongoing verification of the blocklist status and periodic re‑scanning with multi‑engine services are recommended to capture any changes in the host’s behavior.