ledgerrlive-en-io[.]pages[.]dev

The domain ledgerrlive-en-io.pages.dev has been identified as a brand impersonation threat specifically targeting Ledger, a prominent cryptocurrency hardware wallet provider. This domain was designed to deceive users into believing they are interacting with an official Ledger Live service, likely to harvest sensitive information such as recovery phrases or login credentials. The threat type is brand impersonation, and it operates as a phishing site rather than a drainer kit, though the ultimate goal is asset theft.

Technical analysis reveals that ledgerrlive-en-io.pages.dev was registered on September 08, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.47.149. The SSL certificate is issued by Google Trust Services (WE1), lending a false sense of legitimacy. VirusTotal data shows that 16 out of 95 security vendors flag this domain as malicious. It appears on one security blocklist and has been taken offline, with the current page title reading "Suspected phishing site | Cloudflare." The domain is not listed on Google Safe Browsing based on the intelligence provided.

As of the latest check, the domain is offline, indicating that hosting providers or security teams have intervened to disrupt the phishing operation. However, the risk remains elevated because similar domains may still be active or may reappear under different names. Users who have interacted with this site should immediately change their Ledger passwords and enable two-factor authentication. PhishDestroy recommends avoiding any unsolicited links claiming to be from Ledger and always verifying URLs against official sources. The unique seed for this analysis is 7d2bfc.