ldger-support-live[.]pages[.]dev

The domain ldger-support-live.pages.dev was observed on 12 July 2026 and is classified as a high‑risk brand‑impersonation site targeting Ledger users. The site returns HTTP 200 and presents a page titled "Ledger Live – Website App (Desktop & Mobile)", which mimics the legitimate Ledger Live interface. The SSL certificate is issued by Google Trust Services under the WE1 authority, indicating the use of a generic certificate rather than one tied to the Ledger brand.

Infrastructure analysis shows that the domain was registered on 5 April 2026 and is hosted behind Cloudflare’s network. DNS resolution points to IP address 188.114.97.3, which is linked to Cloudflare, Inc. in Canada. The authoritative nameservers are maxine.ns.cloudflare.com and trevor.ns.cloudflare.com, confirming the reliance on Cloudflare’s DNS services. No additional hosting or CDN providers are observed, and the site remains reachable with a valid TLS handshake.

Threat intelligence reports reveal that 10 of 95 security vendors on VirusTotal have flagged the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. These indicators, combined with the explicit impersonation of Ledger’s branding, justify the high‑risk rating and active status.

Defenders should add ldger-support-live.pages.dev to URL filtering and endpoint protection policies, enforce TLS inspection to capture traffic, and educate end users about the fraudulent Ledger Live page. Continuous monitoring of the domain’s DNS records and any changes to its hosting infrastructure is recommended, as threat actors may shift to alternative IPs or certificates while retaining the same malicious landing page.