connect--live-ledga[.]pages[.]dev

The domain connect--live-ledga.pages.dev was registered on 2026-04-28 and is hosted behind Cloudflare’s network (IP 188.114.97.3, CA). It resolves to Cloudflare’s edge service using the nameservers liv.ns.cloudflare.com and sean.ns.cloudflare.com and serves content over HTTPS with a Google Trust Services / WE1 certificate, HSTS, and HTTP/3 enabled. The site returns HTTP 200 and displays the page title “Ledger Live App | Mobile Crypto Management,” directly referencing Ledger’s product line, indicating a brand‑impersonation campaign targeting Ledger users. VirusTotal analysis shows six out of ninety‑one scanners flag the domain, and it is listed on one external blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0/100, reinforcing the malicious classification. Although the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the combination of a Ledger‑related title, a low trust score, and multiple vendor detections suggests a high‑confidence phishing operation. Defenders should add the domain to URL filtering and DNS block lists, monitor for outbound connections to the associated IP, and enforce multi‑factor authentication for Ledger accounts. Users should be warned that any unsolicited request to download or log into Ledger services from this domain is unsolicited and should be reported.