sso-ladger-lv-us[.]pages[.]dev

This domain, sso-ladger-lv-us.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live application interface, presenting a fraudulent wallet setup page titled 'Ledger Live App — Secure Crypto Portfolio & Wallet Setup.' The infrastructure is designed to harvest cryptocurrency wallet credentials and private keys, likely deploying a drainer kit to automate unauthorized fund transfers from victims' wallets. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 28, 2026, and currently resolves to the IP address 188.114.97.3, geolocated in Canada. The domain is flagged by 10 out of 95 security vendors on VirusTotal, with one active security blocklist entry. It is currently blocked by PhishDestroy, though no Google Safe Browsing (GSB) detection is recorded at this time. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common certificate authority for both legitimate and malicious domains. The domain remains active as of this report, posing an ongoing threat to users attempting to access Ledger Live services. Response actions include its inclusion on one security blocklist and detection by multiple antivirus engines, though the lack of broader GSB coverage may limit automated browser protections. Remaining risk is classified as high due to the domain's operational status, credible brand impersonation, and direct targeting of cryptocurrency assets. Users are advised to verify domain authenticity via official Ledger channels, avoid interacting with unsolicited wallet setup links, and monitor connected wallet addresses for unauthorized transactions.