cloud-ladgerlive-app[.]pages[.]dev

This domain, cloud-ladgerlive-app.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain hosts a fraudulent replica of the Ledger Live application interface, likely designed to harvest user credentials or facilitate unauthorized cryptocurrency transactions. The page title, "Ledger Live App – Secure Wallet & Crypto Desktop Setup," closely mimics legitimate Ledger branding, increasing the likelihood of successful deception among users seeking wallet management tools. Infrastructure analysis reveals the domain was registered on April 03, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, associated with Cloudflare’s network in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare’s infrastructure. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection or evasion techniques employed by the threat actor. As of the latest assessment, the domain remains active and unblocked by major browser-based protections, posing an ongoing risk to users. The threat actor appears to be leveraging Cloudflare Pages, a legitimate static hosting service, to evade takedown efforts and maintain operational persistence. Users are advised to verify domain authenticity by cross-referencing official Ledger communications and avoiding interaction with unsolicited wallet setup pages. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as unexpected cryptocurrency transactions or unauthorized access attempts.