io-ledgeir-log-in[.]pages[.]dev

This domain, io-ledgeir-log-in.pages.dev, is identified as a high-risk brand impersonation site targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the domain was designed to mimic the official Ledger Live interface, presenting itself as the legitimate "Ledger Live (Official) — Secure Bitcoin & Crypto Wallet" platform. The threat type is classified as brand impersonation, likely intended to deceive users into disclosing wallet credentials or installing malicious software under the guise of a trusted service. Infrastructure analysis reveals the domain was registered on September 2, 2020, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is associated with an SSL certificate issued by Google Trust Services (WE1). No direct evidence of a crypto drainer kit was observed, but the impersonation framework aligns with credential theft and wallet compromise tactics. As of the latest assessment, the domain has been taken offline, mitigating immediate user exposure. Response actions include its inclusion on blocklists maintained by PhishDestroy, MetaMask, and SEAL, alongside broader takedown efforts. Despite its current offline status, residual risk persists due to the domain’s historical use and potential for re-emergence under altered infrastructure. Users are advised to verify domain authenticity via official Ledger channels and monitor wallet activity for unauthorized transactions.