leddgerlive-app[.]pages[.]dev

This domain, leddgerlive-app.pages.dev, is actively engaged in brand impersonation targeting Ledger, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live application interface, presenting a high-risk threat to users seeking legitimate wallet management tools. The page title, 'Ledger® Live — Getting Started,' further reinforces the deception by closely replicating the authentic brand's nomenclature. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and is currently active despite being flagged by 8 of 95 security vendors on VirusTotal. The domain resolves to the IP address 188.114.96.3, associated with Cloudflare's infrastructure in Canada. It appears on at least one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a detail often exploited to lend false legitimacy. Notably, the domain creation date is listed as April 11, 2026, which may indicate an attempt to evade detection by appearing as a future-dated registration. The site remains active as of this assessment, posing a significant risk to users who may inadvertently disclose sensitive credentials or wallet recovery phrases. Organizations and individuals are advised to block access to this domain immediately and implement network-level controls to prevent interaction. Users should verify the authenticity of any Ledger-related domains by cross-referencing with official sources before entering credentials. Security teams are encouraged to monitor for related indicators of compromise, including the IP address 188.114.96.3 and the SSL certificate thumbprint, to detect potential follow-on attacks.