io-live-ledgjer[.]pages[.]dev

This domain, io-live-ledgjer.pages.dev, is actively engaged in brand impersonation targeting Ledger, a recognized hardware wallet provider. The site presents itself as a technical edition of Ledger Live Wallet, a tactic commonly employed to deceive users into disclosing sensitive credentials or installing malicious software. Current analysis confirms the domain remains operational, posing a high-risk threat to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on September 02, 2020, through Cloudflare, Inc., and resolves to the IP address 172.66.45.24, hosted on AS13335 (Cloudflare, Inc.) in the United States. Security vendors have flagged this domain, with 2 of 95 VirusTotal engines detecting malicious activity. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The domain remains active as of the latest assessment, indicating ongoing risk. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include its IP address. Users should be alerted to verify the authenticity of any Ledger-related communications or software downloads, particularly those originating from non-official domains. Continuous monitoring of related infrastructure is recommended to identify potential pivot points or secondary domains associated with this threat actor.