en-ui-live-legr[.]pages[.]dev

This domain presents a brand impersonation threat targeting users of Ledger Live, a cryptocurrency wallet application. The site mimics the official Ledger Live interface, potentially tricking users into entering sensitive credentials, recovery phrases, or private keys under the false pretense of secure crypto management. The page title, 'Ledger Live — Secure Crypto App (Presentation),' reinforces the deception by closely resembling legitimate branding and messaging. Analysis indicates the domain was registered on April 06, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, suggesting the threat has not yet been widely flagged. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, further confirming its malicious nature. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Users who visited en-ui-live-legr.pages.dev should immediately cease all interaction with the site. If credentials, recovery phrases, or private keys were entered, these should be considered compromised. Affected users must transfer any remaining assets to a new wallet with a fresh seed phrase and monitor their accounts for unauthorized transactions. Additionally, they should revoke any connected app permissions tied to the compromised credentials and enable multi-factor authentication on all related accounts. The domain has since been taken offline, but users should remain vigilant for similar impersonation attempts.