ldgr-live-web-atn[.]pages[.]dev

This domain, ldgr-live-web-atn.pages.dev, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as indicated by the page title 'Ledger Live — Secure Crypto Management App' and the classification in threat intelligence sources. Registered on April 27, 2026, through Cloudflare, the domain resolves to the IP address 172.66.44.96, which is geolocated in Canada and associated with Cloudflare's infrastructure. The site employs HSTS, HTTP/3, and is protected by Cloudflare, with nameservers hans.ns.cloudflare.com and izabella.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1). Analysis indicates that the domain is flagged by 11 of 91 security vendors on VirusTotal, though the specific detection reasons remain unconfirmed. It appears on at least one security blocklist and has been classified as a brand impersonation threat. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, suggesting ongoing malicious activity. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where Ledger or cryptocurrency-related services are used. Given the use of Cloudflare, traditional IP-based blocking may be ineffective; domain-based mitigations are recommended. The exact content and functionality of the site have not been analyzed, so additional indicators of compromise (IOCs) such as embedded scripts, wallet addresses, or redirect chains may exist but are not yet documented. Organizations should monitor for connections to this domain and investigate any associated transactions or credential submissions.