ledger-live-sm[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting users of the 1inch cryptocurrency platform. Analysis indicates the infrastructure is designed to deceive victims into believing they are interacting with a legitimate Ledger Live portal, a common tactic for credential harvesting and unauthorized asset transfers in the decentralized finance sector. Infrastructure analysis reveals the domain ledger-live-sm.pages.dev was registered on September 09, 2025, through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited in phishing campaigns to lend false credibility. Security telemetry shows 5 out of 95 vendors on VirusTotal detect this domain as malicious, and it appears on one security blocklist. The page title, 'Ledger Live — Your Secure Crypto Management Portal,' directly mimics the branding of a trusted hardware wallet interface, increasing the likelihood of successful social engineering. Mitigation requires immediate action from both end users and network defenders. Users should verify domain authenticity by cross-referencing URLs with official 1inch and Ledger communication channels, avoiding any interaction with ledger-live-sm.pages.dev. Network-level protections should include blocking the domain and its resolving IP (188.114.97.3) at firewalls and DNS filters. Security teams are advised to monitor for additional domains leveraging the same Cloudflare Pages infrastructure, particularly those using similar naming conventions or SSL certificate issuers. Given the active status and targeted nature of this threat, organizations handling cryptocurrency transactions should prioritize user education on recognizing brand impersonation tactics in phishing campaigns.