ledgerlive-app[.]pages[.]dev

The domain ledgerlive-app.pages.dev is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Ledger brand. It was registered on April 01 2026 through Cloudflare, Inc., and is hosted behind Cloudflare’s infrastructure (IP 188.114.96.3, located in Canada). DNS resolution uses the nameservers theo.ns.cloudflare.com and zoe.ns.cloudflare.com. The site serves HTTP 200 responses, employs HSTS, HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 trust chain. Security telemetry shows that the domain appears on one blocklist and has been blocked by PhishDestroy. VirusTotal reports a single detection out of 94 security vendors, indicating at least one scanner identified malicious behavior. The page title returned by the server is "Crypto Wallet Platforms Overview," but no further content analysis is available. Given the confirmed use of Ledger’s brand in the impersonation label, the observed infrastructure, and the existing blocklist entry, defenders should treat the domain as malicious, enforce network‑level blocking, and consider sinkholing the associated IP range. Continuous monitoring is advised to detect any changes in hosting or content that could affect mitigation decisions.