ledgerlive-app-run[.]pages[.]dev

This domain, ledgerlive-app-run.pages.dev, poses a high-risk brand impersonation threat specifically targeting cryptocurrency users through fraudulent Ledger Live application interfaces. The site mimics the legitimate Ledger Live platform, a hardware wallet management application, to deceive victims into entering sensitive credentials, recovery phrases, or private keys under the guise of secure crypto management. Given the domain's association with cryptocurrency asset access, successful compromise could result in immediate and irreversible financial loss, including unauthorized transfers of digital assets from connected wallets. Analysis indicates the domain was registered on September 27, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.127, hosted on AS13335 (Cloudflare, Inc.) in the United States. Only 1 of 95 security vendors on VirusTotal has flagged this domain as malicious, suggesting limited detection coverage at present. The SSL certificate is issued by Google Trust Services (WE1), which may lend an appearance of legitimacy to unsuspecting users. Infrastructure analysis reveals the domain is currently active and appears on one security blocklist, with a page title explicitly stating 'Ledger Live App - Secure Crypto Management,' reinforcing the social engineering narrative. Users who have visited ledgerlive-app-run.pages.dev or entered any information on the site should immediately revoke access to any connected cryptocurrency wallets and transfer assets to a new, secure wallet. All credentials, recovery phrases, or private keys exposed to this domain must be considered compromised. It is recommended to monitor all linked accounts for unauthorized transactions and report the incident to relevant financial and cybersecurity authorities. The domain should be blocked at the network level, and affected systems should be scanned for malware to rule out secondary compromise.