leadger-live-well-us[.]pages[.]dev

The domain leadger-live-well-us.pages.dev has been identified as a brand impersonation threat specifically targeting Ledger, a provider of cryptocurrency hardware wallets. Analysis confirms the domain is currently offline, though prior activity impersonated the Ledger Live application interface to deceive users into disclosing sensitive credentials or installing malicious software. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.18. It appears on one security blocklist and was created on May 01, 2024, though the future-dated registration may indicate an attempt to evade detection. The SSL certificate is issued by Google Trust Services, and the page title, 'Ledger Live: Getting Started,' directly mimics the legitimate Ledger onboarding process. Given the domain’s current offline status, no active threat is present; however, organizations and users should remain vigilant. It is recommended to block the domain and associated IP address at the network level, update endpoint protection rules to include this indicator, and conduct retrospective log analysis for any prior interactions. Users should verify the authenticity of Ledger-related communications exclusively through official channels and report any suspicious domains to relevant security teams for further investigation.