lidgercom-en-lear-n[.]pages[.]dev

This domain represents a high-risk cryptocurrency wallet impersonation threat targeting users of Ledger hardware wallets. The infrastructure presents an exact replica of the official Ledger Live login interface, complete with branding elements, step-by-step guides, and authentication prompts designed to harvest cryptocurrency wallet credentials and recovery phrases. Analysis of the page title "Ledger® Live: Login | Getting Started™ — Step-by-Step Guide" confirms the domain mimics legitimate onboarding processes to increase victim trust and compliance. Infrastructure analysis reveals multiple technical indicators supporting malicious classification. The domain lidgercom-en-lear-n.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and currently resolves to IP address 172.66.44.207, hosted on Cloudflare's network in California. Security vendor analysis shows 17 out of 95 engines flag the domain as malicious on VirusTotal, while PhishDestroy maintains an active blocklist entry. The domain uses a Google Trust Services SSL certificate (WE1) to present a false sense of security to potential victims. Users who have interacted with this domain should immediately revoke any entered credentials and assume compromise of sensitive wallet information. All cryptocurrency transactions conducted after visiting this domain should be treated as potentially compromised. Affected users should transfer remaining assets to new wallet addresses using fresh recovery phrases and monitor all connected accounts for unauthorized activity. Security teams should update blocklists to include this domain and its associated IP address 172.66.44.207 to prevent further exposure across organizational networks.