ldgorlive-web[.]pages[.]dev

This domain, ldgorlive-web.pages.dev, is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the page replicates the official Ledger Live interface, using the page title 'Ledger® Live: | Getting started™ with Ledger®' to deceive users into entering sensitive credentials or wallet recovery phrases. No explicit drainer kit signatures have been identified, but the domain exhibits classic phishing infrastructure characteristics designed to harvest cryptocurrency-related credentials. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.66.44.137, located in Canada under Cloudflare’s network. The domain was created on April 01, 2026, though this date may reflect a falsified registration record. VirusTotal detection metrics show 13 out of 95 security vendors have flagged the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns leveraging legitimate certificate authorities to appear trustworthy. As of the latest assessment, ldgorlive-web.pages.dev remains active, posing an ongoing risk to users. No takedown actions have been confirmed, and the domain continues to resolve. Users are advised to avoid interacting with the domain and to verify the legitimacy of Ledger-related communications through official channels only. Organizations should update blocklists to include this domain and its associated IP address. The remaining risk is classified as high due to the domain’s active status, low detection coverage, and direct targeting of cryptocurrency assets.