usa-live-ledgr-io[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live interface, presenting itself as "Ledger® Live: - Getting Started™" to deceive users into interacting with malicious infrastructure. Analysis indicates this is likely a crypto drainer or credential harvesting operation, given the targeted nature of the impersonation and the high-risk indicators associated with the domain. Infrastructure analysis reveals the domain usa-live-ledgr-io.pages.dev was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.24, located in Canada. The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing sites. Despite these indicators, the domain remains active and is only blocked by a single security filter, suggesting limited detection coverage. Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP address (172.66.47.24) across all security controls. Organizations should update endpoint protection rules to detect and block requests to usa-live-ledgr-io.pages.dev and monitor for any attempts to access this domain. Users should be educated to verify the legitimacy of Ledger-related communications by cross-referencing URLs with the official Ledger website and avoiding interaction with unsolicited links. Security teams are advised to review logs for connections to this domain and investigate any potential compromise, particularly in environments where cryptocurrency-related activities are conducted.