sso-ledgrr-live-en[.]pages[.]dev

This domain, sso-ledgrr-live-en.pages.dev, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain mimics the official Ledger Live application interface, presenting itself as a secure wallet app for Windows and Mac systems. The primary threat vector involves credential harvesting and cryptocurrency asset theft, where victims are deceived into entering sensitive recovery phrases or private keys under the guise of a legitimate software update or account verification process. Technical indicators reveal the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. The domain resolves to the IP address 172.66.45.30 and was created on March 24, 2026, though this creation date may reflect an error or manipulation in registration records. Detection metrics show 10 out of 95 security vendors flagged the domain on VirusTotal, while it appears on a single security blocklist. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The domain employs HTTP/3 and HSTS, likely leveraging Cloudflare’s infrastructure to enhance perceived legitimacy and evade basic detection mechanisms. As of the latest assessment, sso-ledgrr-live-en.pages.dev has been taken offline following intervention by security response systems. However, the risk of reemergence under a similar or altered domain remains elevated. Users who interacted with this domain are advised to immediately revoke any entered credentials, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP address, while end-users should verify the authenticity of Ledger-related communications exclusively through official channels.