en-ledgrlive-help[.]pages[.]dev

This domain presents a targeted brand impersonation threat designed to deceive users into downloading counterfeit cryptocurrency wallet management software. Analysis indicates the site mimics the official Ledger Live application interface, presenting itself as a legitimate download portal for secure crypto wallet management. The page title, 'Ledger Live - Secure Crypto Wallet Management App Download,' directly replicates branding elements of the authentic Ledger service, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, with an SSL certificate issued by Google Trust Services. The domain resolves to the IP address 188.114.96.3 and employs security technologies including HSTS, Cloudflare protection, and HTTP/3. Despite these legitimate-seeming technical features, detection metrics show 0 detections out of 95 engines on VirusTotal, though it appears on one security blocklist. Gridinsoft assigns a trust score of 0/100, and the domain has been flagged by PhishDestroy, confirming its malicious classification. Users who visited en-ledgrlive-help.pages.dev should immediately cease all interaction with the site and any downloaded software. Cryptocurrency wallet credentials or recovery phrases entered on this domain should be considered compromised. Affected individuals should transfer assets to new wallets using verified software from the official vendor, monitor accounts for unauthorized transactions, and report the incident to relevant cybersecurity authorities. The domain's current offline status does not eliminate the risk posed by any previously distributed malicious payloads.