ledgrecom-live[.]pages[.]dev

Analysis indicates that ledgrecom-live.pages.dev is an active domain registered on April 11 2026 through Cloudflare, Inc. It resolves to the Cloudflare IP address 172.66.45.32 located in Canada and uses the Google Trust Services / WE1 SSL certificate, suggesting a legitimate‑looking TLS configuration. The authoritative nameservers are george.ns.cloudflare.com and poppy.ns.cloudflare.com, both belonging to Cloudflare. The site returns HTTP 200 and the page title “Ledger Live: Complete Beginner’s Guide to Secure Hardware Wallet Setup | 2024”, directly referencing the Ledger brand. The domain is classified as a brand‑impersonation campaign targeting Ledger and is listed on at least one security blocklist; PhishDestroy has already blocked it. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports six of ninety‑four security vendors flagging the domain, indicating malicious indicators. Current intelligence does not provide details on the page content, payloads, or credential‑stealing mechanisms, so the exact attack vector remains uncertain. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the IP 172.66.45.32, and enforce strict TLS inspection to detect any anomalous payloads. Continuous scanning of the domain with updated sandbox and AV engines is recommended to capture any evolving malicious behavior.