us-leger-io[.]pages[.]dev

This domain, us-leger-io.pages.dev, is an active brand impersonation infrastructure targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain was registered on March 29, 2026, and is hosted through Cloudflare's content delivery network, resolving to the IP address 188.114.97.3. The page title, 'Ledger Live - The Secure Way to Manage Your Crypto,' directly mimics Ledger's official software, suggesting an attempt to deceive users into interacting with fraudulent wallet management interfaces. Infrastructure analysis reveals the use of Cloudflare technologies, including HTTP/3 and HSTS, which are common in both legitimate and malicious deployments. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy while obscuring the true origin of the content. The domain has been flagged by 11 of 95 security vendors, with at least one security blocklist incorporating it into their denylists. Independent verification confirms the domain remains active as of July 12, 2026. What remains uncertain is the exact mechanism of exploitation—whether the site deploys credential harvesting, cryptocurrency address substitution, or malware distribution. The absence of a known phishing kit or additional technical artifacts limits further classification. Defenders should treat this domain as high-risk infrastructure and implement blocking measures at the DNS or network level. Organizations managing Ledger-related assets are advised to monitor for anomalous traffic to this domain and educate users on verifying official Ledger Live distribution channels.