en-ledgr-livv[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics Ledger Live software, potentially deploying crypto drainer scripts or credential harvesting mechanisms to compromise user wallets and recovery phrases. The threat is classified as active and requires immediate attention due to its direct impact on cryptocurrency security. Infrastructure analysis reveals the domain en-ledgr-livv.pages.dev was registered on May 17, 2026, through Cloudflare, Inc. It resolves to IP address 172.66.46.221, located in Canada and associated with Cloudflare's network. The domain appears on one security blocklist and is flagged by 10 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare's infrastructure. The page title, 'Ledger Live — Secure Wallet Demo,' closely resembles official Ledger branding, increasing the likelihood of successful deception. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (172.66.46.221) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to en-ledgr-livv.pages.dev and similar brand-impersonating domains. Users should be educated to verify domain authenticity before entering wallet credentials or recovery phrases, particularly for cryptocurrency-related services. Ledger users are advised to access official resources only through verified channels and enable multi-factor authentication where available. Network monitoring should prioritize detection of outbound connections to this domain or its IP to identify potentially compromised systems.