liveledgr-gaq-en[.]pages[.]dev

This domain, liveledgr-gaq-en.pages.dev, poses a brand impersonation threat targeting users of Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live application interface, presenting itself as an "Official Guide" for secure crypto management. Analysis indicates the domain is designed to deceive users into entering sensitive credentials, such as wallet recovery phrases or private keys, under the guise of providing legitimate software guidance. The risk is elevated due to the direct financial implications of compromised crypto assets, which are often irreversible once transferred to malicious actors. Infrastructure analysis reveals the domain was registered on September 19, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. Security vendor assessments show 6 out of 95 engines on VirusTotal flagged the domain as malicious, while Gridinsoft assigned it a trust score of 0/100. The domain appears on one security blocklist and is blocked by PhishDestroy. Technical indicators include the use of HTTP/3, HSTS, and a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting users. The page title, "Ledger™ Live: Secure Crypto Management® — Official Guide," closely mirrors official branding to enhance credibility. Users who visited this domain should assume their credentials or recovery phrases may have been compromised. Immediate actions include disconnecting any connected wallets from the internet, transferring assets to a new, secure wallet, and revoking any suspicious wallet permissions. It is critical to monitor transaction histories for unauthorized activity and report the incident to relevant crypto security resources. If recovery phrases were entered, the compromised wallet should be considered permanently at risk, and all associated funds should be moved to a new, secure wallet. Users are advised to enable multi-factor authentication on all crypto-related accounts and verify the authenticity of any future Ledger communications by cross-referencing with official channels.