lderglive-support-en[.]pages[.]dev

This domain, lderglive-support-en.pages.dev, is flagged as a high-risk brand impersonation site targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Ledger Live application portal, likely designed to harvest user credentials, recovery phrases, or facilitate unauthorized transactions. The page title, 'Ledger Live | App and Install Ledger Live,' reinforces the deception by replicating the legitimate Ledger Live branding, increasing the likelihood of successful social engineering attacks against Ledger users. Infrastructure analysis reveals the domain was registered on March 29, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.103, located in Canada under Cloudflare's network. The domain appears on one security blocklist and is currently flagged by 2 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to malicious sites. Despite its recent creation, the domain remains active and unblocked by major browser-based protection mechanisms, such as Google Safe Browsing. As of the latest assessment, lderglive-support-en.pages.dev remains operational, posing an ongoing threat to users who may inadvertently disclose sensitive wallet information. Response actions include submission to PhishDestroy for blocking, though broader mitigation requires additional takedown efforts and user awareness. The remaining risk is classified as high due to the domain's active status, low detection rate, and direct targeting of cryptocurrency assets. Users are advised to verify domain authenticity via official Ledger channels and avoid interacting with unsolicited installation prompts or credential requests.