ledger-live-start-cmt[.]pages[.]dev

This domain, ledger-live-start-cmt.pages.dev, is currently under investigation for brand impersonation targeting users of the Across cryptocurrency platform. Analysis indicates the site mimics the official Ledger Live wallet interface, presenting itself as "Ledger Live — Secure Crypto Wallet Manager" to deceive visitors into disclosing sensitive credentials or transferring assets. The threat type is classified as brand impersonation, with Across identified as the primary target of this fraudulent activity. Infrastructure analysis reveals the domain was registered on September 10, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.44.253, located within Cloudflare’s US-based autonomous system (AS13335). Despite its recent creation, the domain has already been flagged by one security blocklist (PhishDestroy), though it remains undetected by all 95 vendors on VirusTotal as of the latest scan. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare’s infrastructure. Notably, the domain’s hosting provider and certificate authority align with patterns observed in other impersonation campaigns, though no additional red flags have been confirmed at this stage. As of the latest assessment, ledger-live-start-cmt.pages.dev remains active and accessible. Users are strongly advised to avoid interacting with the site, particularly those associated with the Across platform or Ledger wallet services. Organizations should consider adding the domain and its resolving IP (172.66.44.253) to network-level blocklists as a precautionary measure. Further monitoring is recommended to track potential changes in detection status or infrastructure, as impersonation domains often evolve rapidly to evade security controls.