us-ldgr-live-wallet[.]pages[.]dev

This domain is under investigation for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The threat type involves fraudulent replication of Ledger's official interface to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled wallets. Analysis indicates the domain was registered recently, with infrastructure designed to evade initial detection while mimicking legitimate services. Infrastructure analysis reveals the domain us-ldgr-live-wallet.pages.dev resolves to the IP address 188.114.96.3, registered through Cloudflare, Inc. on April 05, 2026. The page title was flagged as 'Suspected phishing site | Cloudflare,' and the domain appears on one security blocklist. VirusTotal reports 0/95 detections, suggesting it had not yet been widely flagged by security vendors. The Gridinsoft trust score is 0/100, and the SSL certificate is issued by Google Trust Services. Current status indicates the domain has been taken offline, though historical activity may still pose risks. Mitigation steps for this threat type include verifying domain authenticity before interacting with any Ledger-related services. Users should cross-reference URLs with official Ledger communications and avoid clicking links from unsolicited messages. Organizations should monitor for similar domains using Cloudflare Pages infrastructure, particularly those mimicking cryptocurrency brands. Security teams are advised to update blocklists with the domain and IP address, and conduct retrospective analysis for any prior interactions with this infrastructure. Cryptocurrency users should enable multi-factor authentication and verify transaction details directly on trusted devices.