ledger-live-iq[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site presents itself as a legitimate guide titled 'How to Add and Manage Custom Tokens in Ledger,' likely designed to deceive users into interacting with malicious content or disclosing sensitive wallet credentials. The intent appears to be the deployment of a crypto drainer or credential harvester, given the context of the page and the targeted brand’s association with digital asset management. Analysis indicates the domain was registered through Cloudflare, Inc. on April 30, 2026, an anomalous creation date that may suggest domain spoofing or incorrect registry records. It resolves to the IP address 188.114.96.3, hosted under Cloudflare’s infrastructure in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare’s proxy services. Security vendors on VirusTotal flag the domain at a ratio of 3/95, and it appears on one security blocklist, indicating limited but confirmed detection. The page title and content closely mimic Ledger’s official support materials, increasing the likelihood of successful social engineering. Users who visited this domain should immediately cease all interaction and avoid entering any credentials or wallet details. If sensitive information was submitted, affected parties should transfer assets to a new wallet, revoke any connected dApp permissions, and monitor transaction histories for unauthorized activity. System scans using updated security tools are recommended to detect potential malware. Infrastructure analysis reveals the domain’s reliance on Cloudflare’s network, which may obscure further malicious activity; however, the anomalous registration date and confirmed detections warrant immediate caution.