live-ledger-centre[.]pages[.]dev

This domain, live-ledger-centre.pages.dev, is actively impersonating Ledger, a hardware wallet provider, as indicated by its page title 'Ledger Live Download - Official Landing Page' and confirmed brand target classification. Registered on March 30, 2026, through Cloudflare, the domain resolves to IP 188.114.97.3, hosted on Cloudflare infrastructure in Canada. Analysis reveals the use of Cloudflare nameservers (arturo.ns.cloudflare.com, dahlia.ns.cloudflare.com), HSTS enforcement, and HTTP/3 support, which are consistent with legitimate services but frequently exploited by threat actors to lend credibility to phishing sites. The domain is currently active, returning an HTTP 403 status, which may indicate restricted access or a placeholder state awaiting malicious deployment. It appears on one security blocklist and is flagged by 6 of 94 security vendors on VirusTotal, suggesting detection by multiple engines. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. No specific phishing kit or payload has been confirmed at this time, as the exact content of the page remains unanalyzed. Defenders should treat this domain as a confirmed brand impersonation threat targeting Ledger users. Immediate action includes blocking the domain and its resolving IP at network and endpoint levels, monitoring for related infrastructure (e.g., subdomains, linked IPs), and alerting users to potential credential harvesting or malware distribution risks. Given the domain's association with Cloudflare Pages, defenders may also investigate other pages.dev subdomains for similar activity.