en-live-ledger-us[.]pages[.]dev

The domain en-live-ledger-us.pages.dev is identified as a brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms this domain was designed to mimic the official Ledger Live login interface, with the page title "Ledger® Live: Login | Getting started™ with Ledger®" serving as a direct impersonation attempt. The domain is currently offline, though its prior activity suggests a focus on credential theft or crypto asset compromise. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolved to the IP address 172.66.47.61. The domain was created on March 23, 2026, though this date may reflect misconfiguration or spoofing, as it predates the current year. Detection metrics indicate elevated risk: the domain was flagged by 3 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. It appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, and the site employed technologies including HSTS, Cloudflare infrastructure, and HTTP/3. Current status confirms the domain has been taken offline, though similar impersonation attempts may persist. Users are advised to verify domain authenticity by cross-referencing official Ledger communications and avoiding interaction with unsolicited login prompts. Security teams should monitor for newly registered domains leveraging Cloudflare infrastructure or resolving to similar IP ranges, particularly those mimicking cryptocurrency wallet interfaces. Blocking the IP 172.66.47.61 and domains registered through Cloudflare with anomalous creation dates may mitigate related threats.