ledgelive-eu[.]pages[.]dev

This domain, ledgelive-eu.pages.dev, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Ledger Live application interface, presenting itself as a "Secure Crypto Management App (Desktop & Mobile)" to deceive users into entering sensitive credentials or downloading malicious payloads. The domain is currently offline, but its infrastructure and historical activity remain under investigation. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 15, 2025, and resolves to the IP address 188.114.97.3. It appears on one security blocklist (PhishDestroy) but has not been flagged by any of the 95 vendors on VirusTotal as of the latest scan. The SSL certificate is issued by Google Trust Services, and the domain holds a Gridinsoft trust score of 0/100, indicating a high likelihood of malicious intent. The page title, "Ledger Live — Secure Crypto Management App (Desktop & Mobile)," directly mirrors the branding of the legitimate Ledger Live platform, further corroborating its fraudulent nature. As of the latest assessment, ledgelive-eu.pages.dev has been taken offline, though its prior activity warrants caution. Users who may have interacted with this domain are advised to immediately revoke any credentials or wallet access potentially exposed. Organizations should monitor network logs for connections to 188.114.97.3 and update blocklists to include this domain and associated IP. Cryptocurrency holders are reminded to verify the authenticity of any Ledger-related domains by cross-referencing with the official Ledger website and to enable multi-factor authentication on all accounts.