en-live--io[.]pages[.]dev

This domain was identified as a phishing site impersonating Ledger, a cryptocurrency wallet provider. The site presented itself as the official Ledger Live application, a common tactic used to deceive users into entering sensitive credentials or downloading malicious software. Victims may have been tricked into revealing recovery phrases, private keys, or installing fake wallet applications, leading to potential theft of cryptocurrency assets. The threat primarily targets users familiar with Ledger’s branding, exploiting trust in the company’s reputation to facilitate fraud. Analysis indicates the domain was registered on June 01, 2026, through Cloudflare, Inc., a hosting provider often used to obscure the true origin of malicious sites. At the time of detection, the domain had 0 detections out of 95 security engines on VirusTotal, suggesting it was either newly deployed or evaded initial scanning. The site resolved to the IP address 172.66.46.224 and employed technologies such as HSTS and HTTP/3, which are sometimes used to lend an appearance of legitimacy. The SSL certificate was issued by Google Trust Services, further masking its malicious intent. The domain has since been taken offline but appeared on at least one security blocklist prior to removal. Users who visited en-live--io.pages.dev should assume their interactions were compromised. Immediately revoke any wallet permissions granted during the visit and transfer assets to a new, secure wallet. Scan the device used to access the site for malware, as phishing pages often deploy additional payloads. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If recovery phrases or private keys were entered, consider the associated wallets fully compromised. Report the incident to relevant security teams and avoid interacting with similar domains in the future.