en-lve-ledgre[.]pages[.]dev

The domain en-lve-ledgre.pages.dev is actively engaged in brand impersonation, specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms this infrastructure is designed to deceive users into believing they are interacting with official Ledger Live software, potentially facilitating unauthorized access to crypto assets or credential theft. As of the latest assessment, the domain remains operational and unmitigated. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, an anomalous creation date suggesting potential misuse of domain registration services. The domain resolves to the IP address 172.66.44.65, geolocated to Canada and associated with Cloudflare's network. Detection metrics indicate limited but concerning coverage, with 3 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on a single security blocklist, specifically PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted communication but does not mitigate the underlying threat. The page title, 'Ledger Live | Secure Crypto Wallet,' directly mimics official branding to enhance credibility. Current status confirms the domain remains active, posing an ongoing risk to users unfamiliar with Ledger's legitimate endpoints. Organizations and individuals are advised to block access to en-lve-ledgre.pages.dev at the network level and update endpoint protection rules to include this indicator of compromise. Users should verify domain authenticity by cross-referencing with official Ledger communication channels and avoid interacting with any unsolicited links or prompts. Security teams are encouraged to monitor for additional domains registered under similar patterns, particularly those leveraging Cloudflare Pages infrastructure with anomalous creation dates or impersonating cryptocurrency service providers.