ledger-live-us-anp[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically designed to target Ledger cryptocurrency wallet users. Analysis indicates the site is engineered to deploy crypto drainer malware or harvest credentials under the guise of Ledger Live mobile application guidance. The threat type is classified as brand impersonation with a secondary risk of crypto asset theft, not generic phishing or credential harvesting alone. Infrastructure analysis reveals the domain ledger-live-us-anp.pages.dev was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, geolocated to California. The domain was created on April 19, 2026, though this date may reflect registry manipulation or a placeholder. It appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, including detection for malicious or fraudulent activity. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the inherent risk of the domain’s content. The page title, 'How to use Ledger Live on mobile,' directly mimics official Ledger support documentation to deceive users. Mitigation requires immediate action from both end users and network defenders. Users who accessed this domain should assume credential or wallet compromise and take steps to revoke active sessions, rotate passwords, and transfer crypto assets to new wallets using verified Ledger hardware. Network-level protections should include DNS sinkholing for 188.114.96.3, blocking the domain at perimeter gateways, and deploying endpoint detection rules for crypto drainer payloads. Security teams should monitor for follow-on activity, including outbound connections to known crypto drainer command-and-control infrastructure. Verification of Ledger-related communications should be conducted exclusively through official channels, such as the company’s verified website or support portals.