ledjer-live-io[.]pages[.]dev

Analysis of ledjer-live-io.pages.dev confirms active brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The domain, registered on April 3, 2026, through Cloudflare, Inc., is hosted on Cloudflare Pages infrastructure and resolves to IP 188.114.97.3. The page title explicitly mimics Ledger's official software, displaying 'Ledger Live – Secure Crypto Management,' a direct attempt to deceive users into believing the site is legitimate. Security vendor detections on VirusTotal currently flag the domain, with 13 of 95 engines identifying malicious indicators. The domain holds a Gridinsoft trust score of 0/100 and appears on at least one security blocklist, further corroborating its malicious classification. Infrastructure analysis reveals the use of modern web technologies, including HSTS and HTTP/3, which may be employed to lend an appearance of legitimacy or evade detection. The SSL certificate is issued by Google Trust Services, a common tactic in phishing campaigns to avoid triggering browser security warnings. Despite these technical measures, the domain's registration details, hosting provider, and detection history align with patterns observed in cryptocurrency-related phishing operations. Defenders should treat this domain as high-risk and prioritize blocking or monitoring interactions. Given the target brand and the nature of the impersonation, the site likely aims to harvest cryptocurrency wallet credentials or distribute malicious software. No evidence currently suggests the use of a specific phishing kit or additional payloads, but the domain remains active as of July 12, 2026. Organizations should update filtering rules to include this domain and investigate any historical connections from internal networks.