live-support-leger[.]pages[.]dev

The domain live-support-leger.pages.dev was created on April 27, 2026 and is currently active. Infrastructure analysis shows the domain is hosted behind Cloudflare, Inc., with the authoritative nameservers joel.ns.cloudflare.com and meiling.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which is registered to Cloudflare in Canada and is served over HTTPS using a Google Trust Services / WE1 certificate. The site responds with HTTP status 200 and employs HSTS, HTTP/3, and other Cloudflare technologies. The page title retrieved from the site reads "Ledger Live Download | Secure Crypto App for All Devices," indicating a brand‑impersonation attempt targeting Ledger. Security telemetry indicates the domain is listed on one blocklist and has been blocked by PhishDestroy. VirusTotal scans show 17 out of 91 security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The risk level is classified as high. While the observed infrastructure and detection metrics confirm malicious activity, the exact payload or credential‑collection mechanism has not been publicly disclosed. Defensive teams should block the domain at perimeter and DNS layers, monitor for related C2 traffic to the Cloudflare IP range, and update threat feeds with the observed indicators of compromise. Continuous scanning of the domain for changes to the page content or additional malicious infrastructure is recommended.