en-io-app[.]pages[.]dev

This domain, en-io-app.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site replicates the official Ledger Live interface, presenting itself as the legitimate "Ledger Live - Secure Crypto App" to deceive users into entering sensitive credentials, including private keys or recovery seed phrases. The threat likely operates as a cryptocurrency drainer, designed to siphon funds from compromised wallets upon user interaction. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3, hosted under Cloudflare, Inc. with an IP geolocation in Canada. It was registered through Cloudflare on April 05, 2026, though this date may reflect a falsified or placeholder registration timestamp. VirusTotal detection shows 9 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious domains leveraging free or automated certificate issuance to appear legitimate. As of the latest assessment, en-io-app.pages.dev remains active, posing an ongoing risk to users unaware of the impersonation. Response actions should include immediate blocking of the domain and IP at the network perimeter, as well as dissemination of indicators to relevant threat intelligence platforms. Users who may have interacted with the site should revoke any connected wallet sessions, rotate credentials, and monitor for unauthorized transactions. Despite its active status, the domain’s limited blocklist presence suggests it may still evade detection in some environments, underscoring the need for layered security controls and user awareness.