en-live-l-edgr[.]pages[.]dev

This domain is flagged as an active phishing site targeting Ledger cryptocurrency wallet users. Analysis indicates it impersonates the official Ledger Live interface, presenting a fraudulent login page titled 'Ledger Live | Secure Crypto Wallet' to harvest user credentials, recovery seed phrases, and private keys. The site is designed to deceive victims into entering sensitive information under the pretense of account verification or wallet synchronization, enabling attackers to drain associated crypto assets. Infrastructure analysis reveals the domain was registered on March 26, 2026, through Cloudflare, Inc., and resolves to IP address 172.66.47.201, hosted on Cloudflare infrastructure. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security. Security vendor detection is significant but not unanimous: VirusTotal reports 5 out of 95 engines flagging the domain as malicious, and it appears on one security blocklist. The domain remains unblocked by major browser-based protections, increasing its potential reach. Users who visited en-live-l-edgr.pages.dev should immediately revoke any entered credentials and cease all interaction. If sensitive information such as recovery seed phrases or private keys was submitted, affected wallets must be considered compromised. Users should transfer remaining assets to a new, secure wallet using an air-gapped device and monitor all linked accounts for unauthorized transactions. Ledger hardware wallet users should verify firmware integrity and perform a factory reset if exposure is suspected. No further interaction with the domain should occur, and all local caches or saved passwords associated with the site must be purged.