secure-ledger-liive[.]pages[.]dev

The domain secure-ledger-liive.pages.dev is identified as a brand impersonation threat targeting the cryptocurrency hardware wallet company Ledger. This domain was designed to deceive users into believing they were interacting with an official Ledger service, potentially leading to the theft of sensitive information such as login credentials and personal data.

Infrastructure analysis reveals that secure-ledger-liive.pages.dev was flagged by 14 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among the security community. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.130, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on September 18, 2025, and currently appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services, providing an additional layer of trust that could be exploited to gain user confidence.

The domain is currently offline, suggesting that it has been taken down as part of a security response action. Despite this, the infrastructure remains a potential threat, and users should be cautious of any related domains or IP addresses. The elevated risk level and the presence on multiple blocklists indicate that the domain was actively used for malicious purposes. Continued monitoring and user education are recommended to mitigate the remaining risk.