start-ledgger-live-en[.]pages[.]dev

The domain start-ledgger-live-en.pages.dev is currently active and classified as a high‑risk brand‑impersonation site targeting Ledger. The site presents the page title "Ledger Live – Easy & Secure Crypto Portfolio Management," which directly references the Ledger brand. Registration data shows the domain was created on April 30, 2026 and is hosted behind Cloudflare infrastructure, resolving to IP address 172.66.44.197 with the location listed as CA (Cloudflare, Inc.). Technical analysis reveals the use of HSTS, HTTP/3, and an SSL certificate issued by Google Trust Services / WE1. The Gridinsoft trust score is 0 out of 100, indicating a lack of trust. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal scans show that 7 of 91 security vendors have flagged the domain, reinforcing the malicious assessment. While the page title confirms the impersonation intent, no further content analysis is available, so the exact phishing mechanics remain unknown. Defenders should add start-ledgger-live-en.pages.dev to DNS and URL filtering policies, monitor outbound connections to the associated IP, and consider raising alerts for any traffic attempting to resolve or contact this host. Continuous re‑scanning of the domain is advised to capture any changes in its threat profile.