ledger-on-live[.]pages[.]dev

The domain ledger-on-live.pages.dev is assessed as a high-risk brand impersonation threat. This domain is actively impersonating the cryptocurrency wallet provider Ledger, which can lead to significant financial and personal data loss for unsuspecting users. The threat is particularly concerning due to the domain's active status and its resemblance to legitimate Ledger domains, which could deceive users into providing sensitive information.

Analysis indicates that ledger-on-live.pages.dev is flagged by 11 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among security professionals. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which is located in CA and is associated with Cloudflare. The domain was created on May 01, 2026, and has been marked as active. Additionally, it appears on one security blocklist and is blocked by PhishDestroy, further suggesting its malicious intent. The SSL certificate is issued by Google Trust Services / WE1, which might be leveraged to gain user trust, but the presence of multiple flags and blocklists raises significant concerns about its legitimacy.

To mitigate the risk of brand impersonation, users are advised to avoid interacting with ledger-on-live.pages.dev until its security status is verified. It is recommended to only access Ledger services through official and verified domains. Users should also be cautious of any communications directing them to this domain and should verify the source through multiple channels. Security teams should monitor this domain and consider adding it to their blocklists to prevent potential data breaches or financial losses.