connet-lager-live[.]pages[.]dev

This domain, connet-lager-live.pages.dev, is identified as a brand impersonation threat specifically targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the legitimate Ledger Live application interface, likely to deceive users into entering sensitive credentials or authorizing malicious transactions. The page title, 'Ledger Live Crypto Wallet App,' reinforces this impersonation tactic, suggesting the deployment of a crypto drainer or credential theft mechanism to siphon digital assets from victims. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 06, 2026, an anomalous creation date that may indicate domain squatting or future campaign preparation. The domain resolves to the IP address 172.66.44.143, hosted under Google Trust Services SSL certification, which provides a false sense of legitimacy. Detection metrics show the domain is flagged by 12 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on a single security blocklist, specifically PhishDestroy, and is classified as a brand impersonation threat targeting Ledger. As of the latest assessment, connet-lager-live.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security entities. However, the elevated risk level persists due to the domain's prior association with malicious activity and the potential for re-emergence under similar infrastructure. Users are advised to verify domain authenticity through official Ledger channels, enable multi-factor authentication on all crypto-related accounts, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators of compromise to prevent future exposure.