secure--lejor--live[.]pages[.]dev

This domain, secure--lejor--live.pages.dev, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The threat type is classified as brand impersonation, specifically designed to deceive users into believing they are interacting with the legitimate Ledger Live application. As of the latest analysis, the domain remains active and unresolved, continuing to pose a significant risk to users. Analysis indicates the domain is flagged by 9 of 95 security vendors on VirusTotal, a notably high detection rate for a phishing-related threat. It is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is geolocated in Canada and associated with Cloudflare’s infrastructure. The domain was created on April 03, 2026, an anomalous future date suggesting potential manipulation of registration records. It appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, "Ledger Live Crypto Wallet App," directly mimics the legitimate Ledger Live interface, increasing the likelihood of successful deception. The current status of secure--lejor--live.pages.dev remains active, with no indications of takedown or mitigation. Given the high-risk nature of this threat, immediate action is recommended. Network administrators should block the domain and its resolving IP (188.114.96.3) at the perimeter level. End users are advised to verify the authenticity of any Ledger-related communications by cross-referencing official domains and avoiding interaction with unsolicited links. Organizations handling cryptocurrency assets should implement additional verification steps, such as multi-factor authentication and domain reputation checks, to mitigate the risk of credential theft or financial loss.