ledger-lives-en[.]pages[.]dev

This domain is flagged for elevated-risk brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. The threat involves mimicking the official Ledger Live interface to exploit user trust, likely for credential harvesting or unauthorized transaction redirection. No evidence of direct crypto drainer functionality has been observed, but the infrastructure aligns with pre-attack reconnaissance patterns common in cryptocurrency fraud campaigns. Analysis indicates the domain ledger-lives-en.pages.dev was registered through Cloudflare, Inc. on April 01, 2026, resolving to IP address 172.66.47.67. Security vendors on VirusTotal flagged the domain at a rate of 13/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and employs SSL certification from Google Trust Services. Detected technologies include HSTS, Cloudflare infrastructure, and HTTP/3, suggesting an attempt to appear legitimate while leveraging modern web protocols for evasion. Mitigation requires immediate blocking of the domain and its resolving IP (172.66.47.67) across all network security controls. Organizations should monitor for anomalous connections to Cloudflare-hosted subdomains with similar naming conventions (e.g., *-lives-*.pages.dev). Users should verify the authenticity of Ledger-related communications by cross-referencing with official Ledger domains (ledger.com, ledgerwallet.com) and enabling multi-factor authentication for all cryptocurrency management platforms. Security teams are advised to inspect logs for connections to the domain between April 2026 and its takedown, particularly from endpoints with cryptocurrency wallet software installed.