lej-re-live[.]pages[.]dev

Analysis of lej-re-live.pages.dev shows a recently created (24 March 2026) domain that mimics the Ledger brand, as indicated by the page title "Ledger Live – Desktop Wallet App for Secure Crypto Management" and the explicit "Impersonates: Ledger" tag. The domain is registered via Cloudflare, Inc., and uses Cloudflare's DNS infrastructure (graham.ns.cloudflare.com, summer.ns.cloudflare.com). Network resolution points to IP address 188.114.97.3, which is geolocated to Canada and belongs to Cloudflare's hosting pool. HTTPS is served with a Google Trust Services / WE1 certificate, and the site advertises modern security features such as HSTS and HTTP/3, yet the HTTP response code is 403, suggesting the resource is currently inaccessible.

The domain appears on a single security blocklist and is listed as blocked by PhishDestroy. Independent scanning on VirusTotal returned nine positive detections out of ninety‑four security vendors, reinforcing the malicious assessment. Cloudflare's internal trust scoring assigned a score of 0 out of 100, indicating an extremely low reputation.

The site is presently taken offline, limiting direct content inspection, and no additional behavioral indicators (e.g., login forms or credential harvesting scripts) have been observed. Defenders should immediately block the domain and its associated IP address at perimeter and endpoint layers, and monitor for any new sub‑domains or similar Cloudflare‑hosted assets that reference Ledger or use comparable page titles. Ongoing telemetry should be collected to capture any resurgence of the site, and threat‑intel feeds should be updated to include the domain, its registrar, and the observed infrastructure details for future correlation.