l-ive-ld-gr[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation targeting Ledger hardware wallet users. Analysis indicates the site was designed to deceive victims into entering recovery phrases or private keys under the guise of a legitimate wallet initialization process, enabling unauthorized access to cryptocurrency holdings. Infrastructure analysis reveals the domain was registered through Cloudflare on March 25, 2026, and resolves to IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing infrastructure leveraging reputable certificate authorities to appear legitimate. The domain appears on one security blocklist, and VirusTotal detection shows 9 out of 95 security vendors flagging the domain as malicious. The page title, 'Ledger® Live – Getting Started with Ledger® Wallet,' directly mirrors official Ledger branding, increasing the likelihood of successful social engineering. Mitigation requires immediate action from users who may have interacted with the domain. Those who entered sensitive information should assume compromise and transfer assets to new wallets using fresh recovery phrases. Network administrators should block resolution to 188.114.97.3 and monitor for connections to l-ive-ld-gr.pages.dev in proxy logs. Ledger users should verify domain authenticity by cross-referencing official documentation and only access wallet interfaces through verified sources. Security teams should treat any credentials or keys exposed to this domain as permanently compromised and rotate them accordingly.