en-ledg-live-app[.]pages[.]dev

This domain, en-ledg-live-app.pages.dev, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The site mimics the official Ledger Live application interface, likely aiming to harvest credentials or distribute malicious payloads under the guise of secure crypto management. Current analysis confirms the domain is offline, though prior activity remains a documented risk. Infrastructure analysis reveals the domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.165. It is flagged by 12 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and employs technologies including HSTS, Cloudflare CDN, and HTTP/3. The SSL certificate is issued by Google Trust Services, and the page title explicitly mimics the legitimate Ledger Live App, reading "Ledger Live App | Secure Crypto Management." The domain has been taken offline, though its prior operational state poses residual risks. Users are advised to verify domain authenticity before interacting with any Ledger-related services, particularly those hosted on non-official subdomains or third-party platforms. Monitoring for similar impersonation attempts using the identified indicators—such as the IP 172.66.47.165 and registrar Cloudflare—is recommended. Organizations should update blocklists to include this domain and alert users to potential phishing vectors targeting cryptocurrency management tools.