usa-ledgarlives[.]pages[.]dev

This domain, usa-ledgarlives.pages.dev, is identified as a high-risk brand impersonation threat currently active and targeting Ledger, a cryptocurrency hardware wallet provider. The domain hosts a fraudulent replica of the Ledger Live application interface, designed to deceive users into entering sensitive credentials or private keys under the pretense of secure crypto management. Analysis indicates the page title matches the legitimate service: 'Ledger Live — Secure Crypto Management App | Manage Crypto Safely,' increasing the likelihood of successful social engineering attacks against Ledger customers. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 06, 2026, and resolves to the IP address 172.66.45.11, located in California and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security to visitors. According to VirusTotal, 5 out of 95 security vendors have flagged this domain as malicious, and it appears on one known security blocklist. The domain remains unblocked by major browsers and some endpoint protection systems, allowing continued exposure to potential victims. Current risk assessment classifies this domain as active and highly deceptive, with a significant potential for credential theft and unauthorized access to cryptocurrency wallets. Organizations and individuals are advised to immediately block access to usa-ledgarlives.pages.dev at the network perimeter and endpoint levels. Users should be alerted to verify domain authenticity before entering any sensitive information, especially when prompted by links in emails or social media. Legitimate Ledger communications will never request seed phrases or private keys. Continuous monitoring of related infrastructure is recommended to detect emerging variants or redirect chains associated with this threat.