live-ldgers-eng--en[.]pages[.]dev

This domain, live-ldgers-eng--en.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Ledger onboarding process, presenting itself as "Ledger® Onboarding™ — Official Setup Hub | Ledger.com/start" to deceive users into entering sensitive wallet recovery phrases or private keys. The infrastructure appears designed to facilitate crypto drainer attacks, where victims unknowingly authorize transactions that transfer funds to attacker-controlled wallets. No explicit drainer kit signatures have been identified in initial scans, but the domain’s structure and content align with known crypto phishing campaigns targeting hardware wallet users during setup or recovery workflows.

Technical indicators confirm the domain’s malicious nature. The domain is registered through Cloudflare, Inc., and resolves to IP address 172.66.47.84, geolocated to the United States under Cloudflare’s AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common obfuscation tactic for phishing sites. Created on October 31, 2025, the domain remains active and has been flagged by 11 out of 95 security vendors on VirusTotal. It appears on one security blocklist (PhishDestroy) and is not currently listed on Google Safe Browsing. The page title and branding closely replicate Ledger’s official documentation, increasing the likelihood of successful social engineering.

As of the latest assessment, the domain remains operational, posing an ongoing risk to users attempting to set up or recover Ledger devices. Immediate response actions include reporting the domain to hosting providers and certificate authorities for takedown, as well as updating blocklists to prevent further access. Users are advised to verify domain authenticity by cross-referencing with Ledger’s official website (ledger.com) and avoiding any setup or recovery processes initiated from third-party links. The remaining risk is classified as high due to the domain’s active status, sophisticated impersonation, and direct targeting of cryptocurrency assets. Organizations should monitor for similar domains leveraging Cloudflare Pages infrastructure and educate users on recognizing brand impersonation tactics in crypto-related workflows.