live-ledger[.]pages[.]dev

The domain live-ledger.pages.dev is confirmed to be an active brand impersonation site targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Ledger Live software, potentially leading to credential theft or unauthorized access to cryptocurrency assets. The page title, 'Ledger® Live | Getting Started™ with Ledger®,' directly mimics official branding to enhance credibility. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 25, 2026, and currently resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare, Inc. The domain is flagged by 6 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on one security blocklist and is actively blocked by at least one threat intelligence platform. The SSL certificate is issued by Google Trust Services, specifically the WE1 intermediate, which is commonly used for legitimate and malicious domains alike. As of the latest assessment, live-ledger.pages.dev remains active and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator. Users who may have interacted with the site should immediately revoke any active sessions, reset credentials, and monitor associated cryptocurrency wallets for unauthorized transactions. Security teams are encouraged to correlate this domain with other Ledger-themed phishing campaigns to identify broader patterns of abuse.